Secure Coding mailing list archives

Re: opinion, ACM Queue: Buffer Overrun Madness


From: "Kenneth R. van Wyk" <Ken () KRvW com>
Date: Wed, 09 Jun 2004 15:23:05 +0100


der Mouse wrote:

All that a "better" language will bring you in this regard is that it
will (a) push the sloppiness into places the compiler can't check and
(b) change the ways things break when confronted with input beyond the
design underlying their code.


Although I am in favor of languages that help prevent such nasties as 
input buffer overruns, this is an excellent point.  A sloppy programmer 
will write sloppy code.  Reminds me of an old saying that I heard years 
ago while studying mechanical engineering: a determined programmer can 
write a FORTRAN program in ANY language.  :-)  (Well, notwithstanding 
FORTRAN's built-in ability of handling complex numbers, but I digress...)


IMHO, the bottom line is that there's no excuse for sloppiness and a 
strong language can only do so much to prevent the programmer from 
his/her own sloppiness.


Cheers,

Ken van Wyk
http://www.KRvW.com




Current thread: