So why not take your reasoning a bit further, and write your code in assembly language? We use higher level languages for good reasons, and we choose to pay a small price for the advantages.

Lasser didn't say that higher level languages alone will make code more secure. Nor does his argument imply that we have to use costly tools to implement those languages. Your argument sounds like the classic attack on anything that uses GC. "You can't do that because...it's slow and it's a memory hog."
Well, that's a myth. We can and we do.

There are some poor examples, and there are some good examples, but really this is just a matter of what price you're willing to pay. Perhaps you don't wish to use language X because you've used an implementation of X that doesn't perform as well as you'd like. Ok, that's your experience and your choice. We don't all share your experience and we don't all make your choices.

Lasser's point about insecure code written in C/C++ still stands. We can eliminate buffer overflow bugs for a small price. If that price is too high for you, please understand that others are happy to pay it to get more secure code.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18984#18984