3 ms·
Yet people continue to introduce security vulnerabilities in high level languages all the time. Maybe its not a problem of the language, but of the people?
by ksk 10y ago
Yet people continue to introduce security vulnerabilities in high level languages all the time. Maybe its not a problem of the language, but of the people?
- steveklabnik 10y agoDifferent kinds of security vulnerabilities have different levels of severity. The ones in HLL tend to be not nearly as bad as the ones that come out of C codebases.
- ksk 10y agoYes, to your first point. To the second, I'd argue the impact is the not that much different in most cases. Barring horribly mis-configured systems, networked C/C++ applications execute at the local user level so even if you get an exploit going you're SOL unless you have a local privilege escalation vulnerability in the underlying OS. For a web app, most of them are connected to databases and exploiting a vulnerability there usually allows you to either dump user data, or corrupt memory and execute shell code (leaving you with the same situation as the C code). Usual disclaimers apply - these are oversimplifications for casual conversation purposes yada yada.