Re: Standards for developing secure software

From: Ed Carp (ercat_private)
Date: Thu Jan 23 2003 - 13:57:08 PST

  • Next message: Gustaf Bjorksten: "RE: Standards for developing secure software"

    On Thu, 23 Jan 2003, Alex Russell wrote:
    
    > faster and broken, that just means that it breaks _faster_. Um yeah, I 
    > think I'll pass on that.
    
    The reverse of your argument is that if it's slow and fat, it must be 
    better.  Not true.  Your argument has several logical fallacies which I 
    shall refrain from point out, as they are not germane.
    
    What *is* germane is the fact that security *can* be built into a 
    language, or a library, without a lot of bloat and code slowness.  Just 
    because a language is a relatively high-level language doesn't mean it has 
    to be slow, or bloated, or insecure.
    
    For example, Escapade has many high-level commands that do a lot of work 
    in a small space, saving web programmers from having to manage a bunch of 
    low-level stuff that they shouldn't have to worry about in the first 
    place.  Why write 30 lines of PHP to open a database and read records when 
    you can do it in 4?  Escapade is small, fast, and runs on multiple 
    platforms.  It's written in C, which merely means we had to be careful of 
    boundary conditions, avoid using gets(), strcpy, etc.
    
    <DBOPEN "database", "host", "login", "password">
    <SQL select * from mytable>
    	Record $ID contains $Name<br>
    </SQL>
    
    Escapade takes care of all the low-level stuff of opening the database, 
    keeping track of structures, etc.  So, no, languages don't have to be like 
    Java to be portable.
    
    The whole portability argument that Java supports itself on is a misnomer, 
    anyway - Java runs very poorly (if at all) on small-footprint devices, and 
    it doesn't take away any of the complexity in writing applications.
    



    This archive was generated by hypermail 2b30 : Thu Jan 23 2003 - 16:30:14 PST