4 ms·
I would call that a programmer error. The language certainly does make it harder to write "safe" code, but it is certainly doable. I guess my point is that the
by akg 15y ago
I would call that a programmer error. The language certainly does make it harder to write "safe" code, but it is certainly doable.
I guess my point is that the tools/libraries/frameworks on top of the language are what make it useful or not useful, independent of the language itself. For example, writing a web app in Ruby may not help you against SQL injection (http://en.wikipedia.org/wiki/SQL_injection http://en.wikipedia.org/wiki/SQL_injection) unless you have a well designed query language on top of that.
- tptacek 15y agoEveryone calls it programmer error. But when you make the same error of copying arbitrary-sized inputs from attackers into a Java program, you do not enable that attacker to upload their own code into the JVM process and run it.
- akg 15y agoBut doesn't the use of Java's JNI invalidate any security the JVM offers? As far as I know, any protections the JVM puts up are invalidated once you inject native code, which would potentially enable an attacker to potentially inject malicious code that hijacks the JVM. Then again, one could argue that the JNI is no longer a "Java" program.
- tptacek 15y agoYes, when you write C code and attach it to JVM processes, that puts the JVM process at risk. More C code, more problems.
- dextorious 15y ago"""I would call that a programmer error. The language certainly does make it harder to write "safe" code, but it is certainly doable.""" Everything is "certainly doable" in a turing-complete way, but that fact has not mattered at all in the evolution of programming languages. It doesn't matter if it's "certainly doable", what matters is how easy it is.