Re: Privilege-escalation attacks on NT-based Windows are unfixable

From: Edward Elliott (nobody@127.0.0.1)
Date: 08/28/02 

From: Edward Elliott <nobody@127.0.0.1>
Date: Wed, 28 Aug 2002 00:29:37 GMT

On Tue, 27 Aug 2002 18:11:47 -0400, David Hopwood wrote:
> Barry Margolin wrote:
>> Edward Elliott <nobody@127.0.0.1> wrote:
>> >Another good tactic. I see two ways to go about this. One is to
>> >design new languages and libraries with security in mind.
>>
>> Remember when Java was supposed to be that language? :(
>
> Java is one of those languages. Don't confuse any problems that apply
> only to running hostile code using ClassLoaders, with the properties
> of Java that help in writing secure applications.

If you're talking about avoiding buffer overflows, just about any
language with bounds checking should fit the bill. I don't see how Java
has any special protection against race conditions (synchronized code
helps protect what's in the app, but only if you use it properly. AFAIK,
external resources like files aren't protected from race conditions at
all).

I see Java as a step above C and possibly C++ (depending on how educated
your programmers are on security issues), but no better than any other
language with bounds checking and without raw pointers. Can anyone make
a good case that Java is more suitable for writing secure apps (not
"safe" apps, i.e. sandboxed code) than another language with these
features? What unique features does Java have that "help in writing
secure applications"? 

-- 
Edward Elliott

Relevant Pages

  • Re: Are bad developer libraries the problem with M$ software?
    ... rarely poeple on security lists. ... If you want to add language specific content to the OWASP Guide feel ... > I think that most on the list would agree that, overall, most web apps are ... > programmers when they haven't been offered a clue. ...
    (SecProg)
  • Re: C# and C++ Past, Present, Future :: Software Engineer
    ... i know) easy to write client/server apps, n-tier apps, etc. ... You mentioned templates... ... to be addressed with generics in version 2 of the language. ... able to blend C# and C++, getting the best out of the Java design. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Comparing Lisp conditions to Java Exceptions
    ... All the ISO standards in the world will not make the world ... Nothing keeps you from annotating your program with exceptions based on what ... language should adhere to your theory. ... Curiously, although you don't say it, Java has the opposite problem. ...
    (comp.lang.lisp)
  • Re: casts
    ... This is why most shit programmers refuse to learn languages including ... C Sharp and Java. ... compiler in a later edition of Visual Basic, ... language for processing data. ...
    (comp.lang.c)
  • Re: C, really portable?
    ... > Wait, is Java a modern language superior to C, or is it still ... It is a much better OO language than C++, ... It depends what you are doing, Java aims for rigorous portability - the same ... regardless of platform. ...
    (comp.lang.c)
Quantcast