5 ms·
I am a security professional, but not a developer. You're half correct. Your suggestion of a VM with Haskell would result in a system that could still be made t
by ax0n 17y ago
I am a security professional, but not a developer. You're half correct. Your suggestion of a VM with Haskell would result in a system that could still be made to fail. The methodologies would just work differently.
- ramchip 17y agoCould you back up that claim? lambdabot on #haskell runs arbitrary Haskell code very safely.
- ax0n 17y agoNo, because I know absolutely nothing about Haskell. I do know that if there was a silver-bullet language that was 100% "secure", everyone would be using it. This attack is x86 machine-code-native, so Haskell in a VM is not vulnerable to the exact same problems, but to assume it's completely invulnerable is myopic.
- jpr 17y ago> I do know that if there was a silver-bullet language that was 100% "secure", everyone would be using it. This is completely false. Almost nobody in the software industry cares about safety. This can be proven trivially just by comparing how much more popular C and C++ are compared to memory-safe languages.
- jrockway 17y agoI think he means fail as in allowing you to write a function like: deleteAllFiles user = if user == Root then throwError "access denied" else unsafeDeleteAllFiles Even if memory access is safe, you can still type in the wrong algorithm.
- ax0n 17y agoMost certainly. But further, it's possible to write unintentionally exploitable code in any language.