4 ms·
New tools = New security bugs we still need to find. If you know your tools there is less risk that you produce security bugs. You know the sideeffects of all
by Moru 8y ago
New tools = New security bugs we still need to find.
If you know your tools there is less risk that you produce security bugs. You know the sideeffects of all the commands and functions. If you use a black box and trust it fully, you will (unknowingly) find ways to make new security holes noone ever thought of before.
I'm not saying that we should not innovate, just that we should not rush head first into the blue sky thinking everything is fine just because we use the new shiny thing where we can't make bugs ever.
- pas 8y agoAgreed. Though using conceptually better tools (parser generators) usually has real gains. (Even if it makes the system a bit more rigid. You usually can't just put an "if" in the middle of generated code. But this seems like a sane trade off.)