RE: [SC-L] Programming languages -- the "third rail" of secure coding

2004-08-02 Thread ljknews
At 2:25 PM +0930 8/2/04, Nick Lothian wrote: >What features make Ada safer than Java/C#? (I only have limited experience >with Ada but from memory there was nothing that jumps out at me as something >that Java lacks) Quoting from Tucker Taft in http://www.google.com/groups?selm=FD85Lq.Hyp.0.-s%4

[SC-L] Buffer Overrun

2004-08-02 Thread Mark Rockman
If I allocate a buffer of n bytes, open the channel and receive n+m bytes where m>0, then where does the fault lie? Some possibilities: 1) My choice for n is too small, 2) the software with which I open the channel does not permit me to specify that my buffer is only n bytes in length and it retu

RE: [SC-L] Programming languages -- the "third rail" of secure coding

2004-08-02 Thread Nick Lothian
> >Java/C#: Reasonably safe (both provide protection against > buffer overflows, > >are type safe and provide built-in security mechanisms) > >FORTRAN/COBOL: Don't know - my impression is that COBOL is > fairly safe > >Scripting Languages: Depends on the language. Lack of type > safety can be a

RE: [SC-L] Programming languages -- the "third rail" of secure co ding

2004-08-02 Thread Peter Amey
[snip] > > As engineers, we need "good enough", not perfection. > We also need: (1) To recognise when things aren't "good enough" (2) To have a migration path to "better" Peter ** This email and any files transmitted with