5 ms·
Is it me or should code that has to be secure be written in more manage languages to prevent these mistake ? (But managed languages probably have other security
by Qantourisc 13y ago
Is it me or should code that has to be secure be written in more manage languages to prevent these mistake ? (But managed languages probably have other security issues I don't know about ?)
- longpoke 13y agoNo, it's not just you. I've been saying this for 5 years (Since about a year after I learned to program), and nobody gives a fuck / is competent enough to rewrite the stuff on solid foundations.
- dcsommer 13y agoManaged languages is one way to go, but they are not really appropriate for performance critical libraries like OpenSSL in my book. You can get safety without being managed in modern languages if the compiler does the safety proving for you (e.g. rustlang).
- l0ngpoke 13y ago> Managed languages [...] are not really appropriate for performance critical libraries like OpenSSL This is complete bullshit. Please cite where you found these results. Even if this was true, since the servers also run openssl, you'd be able to at least run a client at 10x/100x/1000x the speed of the server (because the client doesn't have to have concurrent connections), which would make the "slow managed code" fine for a client.
- akjj 13y agoManaged languages are very susceptible to timing attacks.
- pslam 13y agoIf OpenSSL was written in a managed language, someone would need it in an environment a managed language wasn't suitable for, and end up porting it to C.
- longpoke 13y agoThat doesn't even make sense. Also avoid using vague Microsoft-slang. Memory-safe is a much better term.
- Qantourisc 13y agoFor all clarity I meant like C++, ObjC, or others; any language that allows you to create things that enforce consistency during compile or runtime. (Like shared pointer and array containers.) Probably used the wrong terminology here.