3 ms·
History seems to disagree with your basic premise. There are entire classes of security vulnerabilities eliminated by high level language features. (A trivial e
by wtracy 8y ago
History seems to disagree with your basic premise. There are entire classes of security vulnerabilities eliminated by high level language features. (A trivial example: buffer overflows are a non-issue with runtime bounds checking.)
In theory, it's possible to write bug-free code in C or assembly. In practice, it just doesn't happen. The rule of "worse is better" ensures that the rare projects that put in the necessary effort to manually eliminate the bugs that HLLs catch automatically will get steamrolled by projects that don't (witness the adoption rates of Linux versus OpenBSD).
That said: I think that tool developers have only scratched the surface of the possibilities for compile time checks. I'm always amazed how little the industry has learned from projects like Ada. There's an opportunity in there somewhere to have that cake and eat it too.
- pjmlp 8y agoMultics had almost nonexistent buffer overflow exploits in a security analysis thanks to its implementation in PL/I. Ironic how its descendant didn't managed to replicate that feature.
- scns 8y agoIf i remember correctly multics needed ram worth 500000$ to run.
- pjmlp 8y agoI doubt other mainframes were much cheaper, even PDP-11 wasn't properly a bargain. Also Burroughs B5000, developed in 1961, already took security as major OS feature. The problem is that UNIX designers never took security as serious as other OS designers were doing on their OS implementations. Had UNIX been a commercial OS sold at the same price levels as VMS, OS/360 and others, instead of given to universities with a symbolic price due to Bell Labs commercial restrictions and history would have been quite different.
- jacobush 8y agoYes. No widespread adoption of Unix for instance. :)