3 ms·
To me, the headline is misleading. Security is part of the daily programming job, not just of the security specialists. But as a programming language feature, I
by sinuhe69 7y ago
To me, the headline is misleading. Security is part of the daily programming job, not just of the security specialists. But as a programming language feature, I’m not so sure. Certainly some languages present a large attacking surface than the others (like generic pointers or pointers arithmetics) but in general, security is a product of process, not a feature per se. It’s naive to believe when I program in a certain language, my program will be automatically secure (or at least more secure than programs in other languages).
- andrewflnr 7y agoThe programming language is part of your process. To put a finer point on it, your type checker is collaborating with you on a process that results in better security than you would have otherwise. The article starts out talking about a programming languages course, then tries to justify including security therein. I think they're really just hammering home the PL-specific case of your point that "security is part of the daily programming job".
- fulafel 7y agoThe defenders choices are all like this: you can fix some aspects with each, none are sufficient alone. By choosing a non-footgun you eliminate some classes of problems. It's still important to do it.