7 ms·

And yet almost all security problems on the internet involved PHP and JavaScript. When you read about people who have had problems with C, you will find that t

And yet almost all security problems on the internet involved PHP and JavaScript. When you read about people who have had problems with C, you will find that these are people who never really learned the language and the language is as simple as one can get which should also make one question their abilities.

baybal2 7y ago
Siding with you on that. People coming with "no bound checking/type safety/pointer safety/garbage collection in C" often don't get the simple idea they weren't supposed to be there to begin with, and in C the burden of doing in falls on the developer. There is nothing wrong with setting types manually, managing memory manually, and thinking through how pointers and array boundaries are computed. In fact this is what makes C unbeatable in its niche, and leads to software with very low resource and performance requirements.
- ernst_klim 7y ago
  >C the burden of doing in falls on the developer. Aka, C code is doomed to segfault. The routine easily verifiable work should be done by a machine, aka by the compiler.
oblio 7y ago
Half the PHP security vulnerabilities are of the "someone chmoded 777 the Wordpress plugins directory". The other half are C vulnerabilities leaking through the interpreter. And the third half :-) are SQL injections and generic web vulnerabilities. The first batch would happen in any language, it's an operational issue. The second batch comes from C and would likely be prevented by PHP being written in idiomatic Rust. The third batch is a higher level development issue that is cross-language. I think there's value in removing classes vulnerabilities. And blaming the operator is NEVER a good idea. It was the exact opposite of this mentality that made us have safe cars and airplanes today. Before the 70's, the auto industry was doing exactly what you're doing. Once they stopped doing that, people stopped dying for easily preventable issues.

baybal2 7y ago

Siding with you on that. People coming with "no bound checking/type safety/pointer safety/garbage collection in C" often don't get the simple idea they weren't supposed to be there to begin with, and in C the burden of doing in falls on the developer. There is nothing wrong with setting types manually, managing memory manually, and thinking through how pointers and array boundaries are computed. In fact this is what makes C unbeatable in its niche, and leads to software with very low resource and performance requirements.

ernst_klim 7y ago
>C the burden of doing in falls on the developer. Aka, C code is doomed to segfault. The routine easily verifiable work should be done by a machine, aka by the compiler.

oblio 7y ago

Half the PHP security vulnerabilities are of the "someone chmoded 777 the Wordpress plugins directory". The other half are C vulnerabilities leaking through the interpreter. And the third half :-) are SQL injections and generic web vulnerabilities. The first batch would happen in any language, it's an operational issue. The second batch comes from C and would likely be prevented by PHP being written in idiomatic Rust. The third batch is a higher level development issue that is cross-language. I think there's value in removing classes vulnerabilities. And blaming the operator is NEVER a good idea. It was the exact opposite of this mentality that made us have safe cars and airplanes today. Before the 70's, the auto industry was doing exactly what you're doing. Once they stopped doing that, people stopped dying for easily preventable issues.