Re: [Full-Disclosure] automated vulnerability testing

From: Michael Gale (michael_at_bluesuperman.com)
Date: 11/29/03

  • Next message: Devdas Bhagat: "Re: [Full-Disclosure] automated vulnerability testing" 
    To: full-disclosure@lists.netsys.com
Date: Sat, 29 Nov 2003 14:10:55 -0700

    Oh.. I like this thread. I am not a programmer but would like to learn
    and when I want to do something I want to be the best at it and do it
    the right way.

    The right being security first and reliability / speed second.

    So C programming feels like a good challenge.

    Michael.

    On Sat, 29 Nov 2003 15:11:02 -0500
    "Bill Royds" <full-disclosure@royds.net> wrote:

    > Only a good programmer can write safe C.
    > Most programmers are not good programmers.
    > Therefore most C code is not safe and should not be trusted.
    >
    >
    > -----Original Message-----
    > From: full-disclosure-admin@lists.netsys.com
    > [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Peter
    > Moody Sent: November 29, 2003 12:52 PM
    > To: full-disclosure@lists.netsys.com
    > Subject: RE: [Full-Disclosure] automated vulnerability testing
    >
    > > your programmer must be perfect to guarantee security. C is best
    > > used for low level programming where one needs to be close to the
    > > hardware(programming in the small). It is not good for large
    > > applications where modularity and flexibility are more important (
    > > programming in the large).
    >
    > and for large applications where the programmer needs to be close to
    > the hardware (programming in the?). like the 3.5 million lines of C
    > code that comprise the linux kernel...
    >
    > I'm sick of lazy programmers who keep complaining how C doesn't hold
    > your hand VB or some crap. The language does not the coder make. A
    > good programmer will be able to make lisp, C, smalltalk (etc. etc.) do
    > what they need it to.
    >
    > --
    > Peter Moody <peter@ucsc.edu>
    > Information Security Administrator 831/459.5409
    > Communications and Technology Services. UC, Santa Cruz.
    > http://security.ucsc.edu/pgp/peter.moody.pub
    > :wq
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Devdas Bhagat: "Re: [Full-Disclosure] automated vulnerability testing"

    Relevant Pages

    • Re: Is it time for secure C ?
      ... This is certainly possible (especially with C99 VLAs ... but is the proposed "security" worth ... array out with NUL bytes is removed! ... the programmer to provide output character arrays big enough to hold ...
      (comp.lang.c)
    • Re: security enhacement to C runtime library (XXX_s)
      ... In the below link MS announces a security update to the C runtime ... Every buffer overflow error that was made before can still be ... strings in C the way they are used in every other programming ... how can we increase the programmer ...
      (comp.std.c)
    • Re: pid from startet process
      ... programmer expects. ... generate new candidates for PIDs by incrementing a counter. ... have not, however, yielded on the claim of a security threat posed ... the introduction of a system with randomized PIDs increased ...
      (comp.lang.perl.misc)
    • Re: [Full-Disclosure] Antigen Path Disclosure
      ... Im not a part of the security industry itself, im a programmer. ... But Still decided to uploaded 2 dodgey files and a jpg like he was ...
      (Full-Disclosure)
    • Re: need free support in IT? [Glasgow]
      ... I am a Sun Certified Programmer for the Java 2 Platform, ... GNU/Linux operating system administration (security, samba, Apache, ... interested in Open Source operating systems and software, networking, ... If you think, that your company could take advantage of my skills, and, ...
      (uk.local.glasgow)