You remind me of what I like to call the "Java Faithful", people who think that everything (and I mean everything) should be written in Java (or some other ultra-high-level language). They think that only their opinion on the subject matters; they think that everyone has a Pentium 4 with 1GB of Ram, and they think that they're not behaving badly by telling everyone the world over to use their pet tool instead of the tool the developers would like to use.

Understand one thing. Developers code in the tools which are best suited to their development environment and their requirements (requirements including, by the way, the use of Free Software for many of us). If I want to work in C++ I will do so; if I think it's safer to use gcc than javac because gcc is Free Software, and javac is not, then I will do so. Doing so does not make me a macho asshole. Doing so does not mean I'm thoughtlessly risking bugs (as if using Java automatically saves you from these -- how silly). Doing so merely means I've thought out which language I want to use, and I've chosen C++ over Java. Maybe I don't have the money to spend thousands on the latest, greatest equipment, and want to be able to support other people like me. Maybe I've been programming in C++ for ten years, and don't feel like dumping all my skills just because YOU say I should. Maybe I'm perverse. It doesn't matter. If I want to use C++, I will, and your criticism is pointless and childish.

If you're really worried about bugs, how about telling people the TRUTH: stop making your scripts and programs SUID or SGID, configure them to use their own user with limited permissions if necessary, and spend some extra time securing your code with an audit.

Quit advertising Java and Perl, already. Religious wars are rude.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18820#18820