Re: Unexecutable Stack / Buffer Overflow Exploits...

Jesse Pollard (pollard@tomcat.admin.navo.hpc.mil)
Tue, 28 Dec 1999 15:49:51 -0600 (CST)

>One question always comes to my mind when I read those security
>advisories (especially when they deal with software which has
>`security' on its feature list): Why are people using C for project
>which explicitly aim at security, although experience has shown that
>it is extremly difficult to write secure software in C? Why don't they
>use a programming language in which buffer overflows cannot happen?

1. speed
2. portability
3. availability
4. familiarity

The most common language at present is C.

ADA tends to execute slow or requires a lot more resources to run fast
(and buffer overflows can still happen). ADA is also cumbersome to use,
think about trying to write an X server in ADA; it could be done, but I
wouldn't want to try.

Java has a speed problem, and is not easly written. It also cannot reach
some of the low-level interfaces that is needed for hardware access.
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil

Any opinions expressed are solely my own.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/