Dear Mister Lasser.

I do feel that you have not thought long and thorough about this article before you pressed the "publish" button. Even though it is unfair I really do nto have the time to split every paragraph apart, yet let me comment on a rather broad basis.

I am one of those "too cool" programmers which has used ASM and C for years. I am very dilligent when it comes to my coding, I take the time to analyse and learn from my mistakes. I read security related mailing lists and I try to stay on top of things to avoid new hazards imposed through badly written code. When it comes to designing good code and optimizing a tool for a specific task the human ingenuity and sometimes human precision cannot be surpassed by any offered tool. High level languages have compiler subsystems which have been written by humans, often in low level languages and those are susceptible to the same mistakes you "complained" about.

I have made mistakes and I have been given the chance to learn from them. It is a matter of choice to write secure code and has nothing to do with being cool enough to understand what a typecast or struct does or is for.

When you run a mail clint like mutt for 300 or even 1000 Users on a single, yet powerful machine, you will have a much better time as system administrator when it is written in an optimized way in a language which allowes you to tweak such things. Personally I do not feel that Java is suited for many things, it has its place but that is it.

The day people start running a Java shell application on my Server to get their mail, I shall terminate my job.

I do feel strongly about it, I hope some things are clarified.

It is never the tools that create a result, it is always the one using the tools in a specific way.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18835#18835