First of all, he misses two key points on why security holes exist.

1. There never has been "requirements" about security when writing code for an application. Maybe if you are building something for the defense department...

2. He says to not use C/C++, but he doesn't say what to use. And he refers to languages like Perl, Python, ... and says that you can still have security holes using these tools.

To his credit, he does suggest using other tools which will help contain bugs like this. But will this eliminate them? Probably not, but they will probably minimize them.

Therefore, number 2 doesn't apply since even higher level languages can have security issues.

Number 1 does apply. We need to code for security in everything.

And therefore, his whole argument about the "macho C/C++" coder is bogus, because he has no basis for his argument.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18821#18821