Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]
In some mail from Jim Harrison, sie said:
>
> ..and similar statements can be made for Basic (pickyourflavor) as well.
> This argument proves my point that there is no such thing as a truly
> "secure" language; it's entirely dependent on the dev skills.
I disagree. But then the above could be taken to be just flame-bait.
In functional programming languages (think 4GLs like prolog), rather
than functional programming languages (2 and 3GL - C/Pascal/perl/etc),
the ability of a programmer to do something that exposes a security
problem is greatly diminished (if we exclude "shell escapes", etc.)
Where do 9 out of 10 security problems with applications arise from?
Dealing poorly with externally supplied input.
This is the crux of nearly *all* PHP security bugs.
Maybe our problem is that PHP, perl, etc, are all built on top of C
and in such a manner that the origin and trustworthiness of data is
lost and can no longer be delt with in an appropriate fashion.
So maybe there isn't a "secure" functional language yet but I can't
see why we can't develop one.
Darren