<<< Date Index >>>     <<< Thread Index >>>

Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]



On Jan 2, 2007, at 10:37 AM, Darren Reed wrote:
In some mail from Jim Harrison, sie said:
Again; I agree with and fully support the effort.  What I'm trying to
point out is the literal impossibility of actually achieving "genuine
security" in either our code or the languages it's written in.
Well given that the ultimate root of any invention is going to be
human, you're saying "genuine security" is impossible.

"Genuine Security" is a marketing term (a misleading one, at that). A programming language without security risks is pretty much useless. A capable web programming language without security risks is darned near impossible.

I'm quite confident that someone could develop a very secure
interpreted language.  It might not do a lot, but it could easily
be done (even if only to prove you wrong) - if one doesn't already
exist.  I could probably even prove a case with /bin/sh.

Sorry, /bin/sh needs read access to /etc/passwd for uname checks, and thus, allows for information disclosure.

Hm.

LOGO is pretty safe to use. I'm not sure how much you can do with it anymore. You might be able to draw web pages.... really.... slowly.....

The problem we have right now is that the language commonly used for
dynamic web pages on non-Microsoft platforms is PHP and that this has
not been engineered *for security*.

PHP was engineered with the power (and responsibilities) of C. It allows for on-the-fly database administration, file access at the level of permission given to the web server process, and input/output at the level of raw data streams.

PHP is not a web "scripting" language, so much as a scripting interface to raw binary libraries on the disk, and raw machine resources. Thus, if an admin wants to build a PHP program to administer a massive DB cluster at the CLUI level, they can. If they want to run the world's largest online encyclopedia, they can.

They can also write an address book.

The goal of a language such as PHP should be to make it possible
to do what is required without the person using it needing to know
anything about security or secure programming practices.

I think you might be a tad confused about the goals of PHP, or hoping that their goals match yours.

"PHP, which stands for "PHP: Hypertext Preprocessor" is a widely-used Open Source general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Its syntax draws upon C, Java, and Perl, and is easy to learn. The main goal of the language is to allow web developers to write dynamically generated webpages quickly, but you can do much more with PHP."

Note: "web developers", not "bored college students who tend to put SQL arguments into a GET string" or "oops, I didn't bother to check my args because the bong distracted me".

Just because it's easy to learn how to use a gun does *not* give people license to shoot themselves in the foot and then complain that the gun was "too easy to use".

Just as
people using perl generally don't need to worry about buffer
overflows,

Er, what? As soon as a perl user "glues" into an external library, they better start to worry about such things, or expect to get a pink slip.

why should people using PHP need to worry about SQL
escapes and filepath issues?

Let us entertain your idea.

Let us imagine a language that is near useless for database administration, because all of the "dangerous" statements to drop tables, or bulk update data, are removed. Let us imagine a language where every "dangerous" file path is removed, and thus, renders the language useless for any operation that traverses a file path. Let us imagine a language that only allows for limited looping, so it cannot suck too much CPU. Let us imagine a language where all data is "auto-sanitized", so it cannot handle complex binary streams.

PHP is *not*, and *never has been*, this language.

Perhaps, though, there is such a need for such a language that it can be developed...

...but I wouldn't use it, and neither would most of the people who need powerful code tools. I suggest you study the last 10 years of "web languages", it's a veritable highway of death of similar intentions, and dead-ends.

-Bop