4 ms·

"... you can write insecure code in it," he underscores his point, "but that's a fundamental problem in every single programming language" No, there are la

"... you can write insecure code in it," he underscores his point, "but that's a fundamental problem in every single programming language" No, there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do.

gabordemooij 13y ago
Can you give an example? In the context of web development of course...
- adamnemecek 13y ago
  http://www.impredicative.com/ur/ http://www.impredicative.com/ur/ http://plv.csail.mit.edu/ur/ http://plv.csail.mit.edu/ur/
  - gabordemooij 13y ago
    Never heard of this language. But thanks for sharing. This is an interesting language. Not sure whether I should use it right away (always sort of tied to a certain language and ecosystem, in my case PHP) but at least we can get some inspiration from innovative approaches like this.
    - adamnemecek 13y ago
      It's a research language and it seems very rough around the edges so using it in production might be a bad idea. That being said this is supposedly written in the language https://bazqux.com https://bazqux.com.
- gabordemooij 13y ago
  Probably answering my own question here but now I think of it, there is no language I can think of that catches SQL injection etc, but there seems to be server that does! http://www.hiawatha-webserver.org/ http://www.hiawatha-webserver.org/ I have no experience whatsoever with this beast but it says it kills SQL injection, XSS etc. Curious whether this would be effective.
- morganherlocker 13y ago
  Its been a while since I did any ASP.Net, but I remember some sort of error that would be thrown by default for common sql injection or script injection patterns on user inputs. There were still many many ways to screw things up, but this probably prevented quite a few attacks for extra lazy/ignorant coders (we have all been there at one point or another).
- dbpatterson 13y ago
  Not sure if I agree with OP, but this language/framework makes most common web vulnerabilities impossible: http://impredicative.com/ur/ http://impredicative.com/ur/
kijin 13y ago
> there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do. Where is this wonderful language that throws compiler warnings when the code contains an SQL injection, XSS, or CSRF vulnerability?
- adamnemecek 13y ago
  http://www.impredicative.com/ur/ http://www.impredicative.com/ur/
- Shish2k 13y ago
  Not a complete solution, but I thought perl's "taint" feature was a brilliant idea, and I wish more languages did similar. In short, data provided by the user is automatically marked as "tainted", and cannot be passed into a shell command, an SQL string, printed into the HTML, etc, without being explicitly converted into a safe form. (I'd particularly like it if it were possible for the user to define their own types, so we could have "raw string", "validated HTML string", "validated SQL string", etc - and also "distance in meters", "distance in feet", etc -- and it wouldn't be possible to operate on different types without explicitly converting them into compatible forms)
  - adamnemecek 13y ago
    Ruby has it too.
- plorkyeran 13y ago
  Haskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that you're wrong). If you loosen the requirement to just "secure by default" rather than "insecure code fails to compile", most modern web frameworks have built-in automatic CSRF protection and default to escaping all strings when inserting them into HTML.
splawn 13y ago
any language could print out a hardcoded string of your root password
abjorn 13y ago
That's a bit of a broad statement, maybe - I'd be interested to see a general purpose language that will not allow you to write insecure software, I have a hard time believing that exists. But you're coming from the right place - it's absolutely the job of the programming language to at least make it more difficult to do so and encouraging good security practices, and PHP does not do a very good job of that. Then again, I write JavaScript for a living so I suppose I don't have much room to criticize on that front.

gabordemooij 13y ago

Can you give an example? In the context of web development of course...

adamnemecek 13y ago
http://www.impredicative.com/ur/ http://www.impredicative.com/ur/ http://plv.csail.mit.edu/ur/ http://plv.csail.mit.edu/ur/
- gabordemooij 13y ago
  Never heard of this language. But thanks for sharing. This is an interesting language. Not sure whether I should use it right away (always sort of tied to a certain language and ecosystem, in my case PHP) but at least we can get some inspiration from innovative approaches like this.
  - adamnemecek 13y ago
    It's a research language and it seems very rough around the edges so using it in production might be a bad idea. That being said this is supposedly written in the language https://bazqux.com https://bazqux.com.
gabordemooij 13y ago
Probably answering my own question here but now I think of it, there is no language I can think of that catches SQL injection etc, but there seems to be server that does! http://www.hiawatha-webserver.org/ http://www.hiawatha-webserver.org/ I have no experience whatsoever with this beast but it says it kills SQL injection, XSS etc. Curious whether this would be effective.
morganherlocker 13y ago
Its been a while since I did any ASP.Net, but I remember some sort of error that would be thrown by default for common sql injection or script injection patterns on user inputs. There were still many many ways to screw things up, but this probably prevented quite a few attacks for extra lazy/ignorant coders (we have all been there at one point or another).
dbpatterson 13y ago
Not sure if I agree with OP, but this language/framework makes most common web vulnerabilities impossible: http://impredicative.com/ur/ http://impredicative.com/ur/

kijin 13y ago

> there are languages where you can't write insecure code, where the compiler doesn't allow it and will warn you when you do. Where is this wonderful language that throws compiler warnings when the code contains an SQL injection, XSS, or CSRF vulnerability?

adamnemecek 13y ago
http://www.impredicative.com/ur/ http://www.impredicative.com/ur/
Shish2k 13y ago
Not a complete solution, but I thought perl's "taint" feature was a brilliant idea, and I wish more languages did similar. In short, data provided by the user is automatically marked as "tainted", and cannot be passed into a shell command, an SQL string, printed into the HTML, etc, without being explicitly converted into a safe form. (I'd particularly like it if it were possible for the user to define their own types, so we could have "raw string", "validated HTML string", "validated SQL string", etc - and also "distance in meters", "distance in feet", etc -- and it wouldn't be possible to operate on different types without explicitly converting them into compatible forms)
- adamnemecek 13y ago
  Ruby has it too.
plorkyeran 13y ago
Haskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that you're wrong). If you loosen the requirement to just "secure by default" rather than "insecure code fails to compile", most modern web frameworks have built-in automatic CSRF protection and default to escaping all strings when inserting them into HTML.

splawn 13y ago

any language could print out a hardcoded string of your root password

abjorn 13y ago

That's a bit of a broad statement, maybe - I'd be interested to see a general purpose language that will not allow you to write insecure software, I have a hard time believing that exists. But you're coming from the right place - it's absolutely the job of the programming language to at least make it more difficult to do so and encouraging good security practices, and PHP does not do a very good job of that. Then again, I write JavaScript for a living so I suppose I don't have much room to criticize on that front.