I'd say this article is fairly redundant, stating many things that have been stated many times in the past.

However his choice of bug examples seems odd:

linux kernel ptrace - given the performance-critical status of the kernel, use of high efficiency languages seems appropriate. I haven't been able to find enough information of this vulnerability to know if it is language-feature specific or not.

OpenSSL timing attack - This is an algorithmic issue, and using a less efficient language (slower to execute) would make this problem worse, not better, by making it easier to detect the difference in execution time.

The MySQL config file vulnerability - This is an insecure file handling bug, and is not dependent on language. It's taking advantage of mysql's ability to over-write it's own configuration file.

It seems strange to me that the first three examples he cites aren't particularly relevant to supporting his argument. To his defense, He did say that "most" of those bugs were related, not all, but you'd think that at least the first 3 would be good examples.


Certainly the OpenSSL timing attack doesn't even deserve mention in this article, as his proposed "solution" to all of the world's programing security problems would actually make this problem substantially worse. If anything, it's an example _against_ very high level languages.

It seems to me like this article is a rehash of things said by others, written by someone who either doesn't understand the problem, or didn't take the time to read the security holes he was citing. What a shame, it may have had some potential to add some insightful commentary to this well known debate.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18830#18830