Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's another aspect of it. Please see this answer of mine:

https://news.ycombinator.com/item?id=27642630

In short, memory unsafety makes programmer bugs exploitable, instead of generally just failing.



I understand what you are saying, and I understand that this is a real security issue in modern computing. However I would put the question to you in a different way:

Let's say we have two programs, A and B.

Program A by its very nature needs to have write access to the system's file permissions in order to fulfill its core purpose.

Program B only needs R/W access to a sqlite database installed in a specific directory, and the ability to make network calls.

I would agree that for program A, a memory-safe language can provide a very real benefit, given the potential risk compromising this program could expose the system to.

Would you agree that if a buffer overflow exploit in Program B can be used to compromise the system outside of the required resources for that program, this is a failing of the OS and not the programming language?


I agree with that — not having buffer overflows is a good to have but not sufficient thing for security. MAC and sandboxes are a necessity as well, eg SELinux can solve your proposed problem with program A and B.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: