4 ms·
Several classes of security problem, including the Heartbleed bug, are impossible or very unlikely in a language that doesn't have manual memory management. Hi
by SwellJoe 12y ago
Several classes of security problem, including the Heartbleed bug, are impossible or very unlikely in a language that doesn't have manual memory management.
His assertion is theoretical...he assumes a Go implementation will be superior based on this removal of a huge class of potential problems. But, it is difficult to be certain without an audit and a lot of real world testing and experience with the library. It is not unreasonable, however, to assume that security libraries in a language like Go could be safer than similar libraries in a language with manual memory management like C/C++.
Purely functional programming and programming without side effects (as in Haskell) can also reduce some types of error and make for more provably correct software, but Go is not particularly pure in this regard...but, as I understand it, can be used in a manner that is similar in many ways. Again, this could prevent entire classes of common security problem.
- diminish 12y agoThanks for nice explanation. My crypto class teacher on coursera (Dan Boneh of Stanford) used to repeat one thing again and again; "Don't design or implement crypto systems yourself". His argument was that crypto required the validation of time and a lot of experts (working as adversaries). From this point of view, a young language or implementation seems to be at a disadvantage compared to older ones. Of course fresh memories of Hearbleed seems to contradict what I say. But what doesn't kill OpenSSL makes it stronger or (get forked).