9 ms·
In some ways, C is more secure than Python because it doesn't support eval. Things like pickle can easily be abused. Also, I notice you completely snipped the
by cmccabe 13y ago
In some ways, C is more secure than Python because it doesn't support eval. Things like pickle can easily be abused.
Also, I notice you completely snipped the point about using process separation. Sigh. Mistakes of the past, doomed to repeat, and all that.
- tptacek 13y agoC does support eval. C calls it "trying to copy strings".
- cmccabe 13y agoI'm really annoyed by your refusal to stay on topic. I pointed out a specific problem with security in many higher level languages-- the presence of eval and eval-like constructs in the language. You changed the topic. I pointed out that minimizing the size of the trusted code base, and reducing the privileges with which code runs is the foundation of any successful attempt to make secure coding easier. You changed the topic. I'm really tired of the ideology that everything written in C is insecure, and everything written in higher-level languages smells like roses. Should we be surprised that things like Wordpress, Ruby on Rails, and even client-side Java are riddled with security vulnerabilities? Well, when programmers refuse to learn from the mistakes of the past, and think using a higher-level language is a magic elixir for achieving security, it's not a surprise.
- deleted 13y ago[deleted]