3 ms·

> the language is the problem It was literally weeks after Heartbleed. The screams for modern languages with managed runtimes had barely subsided. Then Tomcat,

by xorcist 11y ago

> the language is the problem It was literally weeks after Heartbleed. The screams for modern languages with managed runtimes had barely subsided. Then Tomcat, in common use world wide in the poster boy managed language, had a bug with exactly the same impact. Nobody abandoned Java after that. Just as nobody will abandon C because of this. > Ruby isn't great, but it's not had anything like the same defect rate I would argue it's had much worse, altough the comparison is difficult to make. Rails against Apache perhaps, where Rails has had several problems of this magnitude. I like modern languages as much as the next guy, but I'm very tired of "the language is the problem". Shoving more layers of abstraction in there is not a silver bullet for security. We need to look more at system programming languages.

lmm 11y ago
> It was literally weeks after Heartbleed. The screams for modern languages with managed runtimes had barely subsided. Then Tomcat, in common use world wide in the poster boy managed language, had a bug with exactly the same impact. You're talking about POODLE? Not remotely the same impact. It was a severe vulnerability, but it only leaked plaintext, not key material. > I like modern languages as much as the next guy, but I'm very tired of "the language is the problem". Shoving more layers of abstraction in there is not a silver bullet for security. We need to look more at system programming languages. It's not about adding abstraction. There are plenty of safe systems programming languages. The problem is specifically C.
- xorcist 11y ago
  > You're talking about POODLE? Why would I? That wasn't Tomcat, and it didn't leak keys. I won't read through the CVE list right now (because it is long, and that's only counting Tomcat and not the JRE itself), but it reused buffers and leaked potentially anything, very much like Heartbleed. If you were in a Java shop at the time you know about it. > It's not about adding abstraction. There are plenty of safe systems programming languages. No true Scotsman, eh? Most people who go about how the world would be saved if we just got rid of C are provably wrong, because popular application in their pet language are just as bad. It used to be Java fanboys, that's why I mentioned Tomcat. Then it was Ruby (and don't get me started on the security disasters Rails brought with it). Most of these do indeed pile abstractions on popular data structures to minimize the possible errors. There are promising languages, but none in popular use, and very far from something you could audit.
  - lmm 11y ago
    > If you were in a Java shop at the time you know about it. False; I was in a Java shop at the time and I don't know about it (though we ran things on Jetty (and later Netty) rather than Tomcat because we felt the code quality was higher).

by xorcist 11y ago

lmm 11y ago

> It was literally weeks after Heartbleed. The screams for modern languages with managed runtimes had barely subsided. Then Tomcat, in common use world wide in the poster boy managed language, had a bug with exactly the same impact. You're talking about POODLE? Not remotely the same impact. It was a severe vulnerability, but it only leaked plaintext, not key material. > I like modern languages as much as the next guy, but I'm very tired of "the language is the problem". Shoving more layers of abstraction in there is not a silver bullet for security. We need to look more at system programming languages. It's not about adding abstraction. There are plenty of safe systems programming languages. The problem is specifically C.

xorcist 11y ago
> You're talking about POODLE? Why would I? That wasn't Tomcat, and it didn't leak keys. I won't read through the CVE list right now (because it is long, and that's only counting Tomcat and not the JRE itself), but it reused buffers and leaked potentially anything, very much like Heartbleed. If you were in a Java shop at the time you know about it. > It's not about adding abstraction. There are plenty of safe systems programming languages. No true Scotsman, eh? Most people who go about how the world would be saved if we just got rid of C are provably wrong, because popular application in their pet language are just as bad. It used to be Java fanboys, that's why I mentioned Tomcat. Then it was Ruby (and don't get me started on the security disasters Rails brought with it). Most of these do indeed pile abstractions on popular data structures to minimize the possible errors. There are promising languages, but none in popular use, and very far from something you could audit.
- lmm 11y ago
  > If you were in a Java shop at the time you know about it. False; I was in a Java shop at the time and I don't know about it (though we ran things on Jetty (and later Netty) rather than Tomcat because we felt the code quality was higher).