4 ms·

Reason why people defend unsafe languages: If you make it idiot-proof, someone will make a better idiot.

• MichaelGG 12y ago
  Care to point out all the RCEs that exist in the millions of lines of C# and Java out there? Apart from exec/eval I don't recall seeing a single one (I'm sure there's a few where they interop or use unsafe code.)
  • kevinr 12y ago
    http://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-6117/opec-1/Apache-Struts.html http://www.cvedetails.com/vulnerability-list/vendor_id-45/pr... That's 12 just in one of the more popular Java web frameworks. RCE is possible in any language.
    • MichaelGG 12y ago
      Those appear to be all exec/eval type bugs. Yes, if you do "eval($querystring)" you've got a problem in any language, including C.