Secure Coding mailing list archives

Retrying exceptions - was 'Coding with errors in mind'


From: mshines at purdue.edu (Michael S Hines)
Date: Tue, 5 Sep 2006 08:25:42 -0400

That's a rather pragmatic view, isn't it?

Perhaps if other language constructs are not used, they should be removed?

OTOH - perhaps the fault is not the language but the coder of the language?

  - lack of knowledge
  - pressure to complete lines of code
  - lack of [management] focus on security
  - or 100s of other reasons not to do the right thing...

Sort of like life, isn't it?

Mike Hines

-----Original Message-----
From: sc-l-bounces at securecoding.org [mailto:sc-l-bounces at securecoding.org]
On Behalf Of Jonathan Leffler
Sent: Friday, September 01, 2006 3:44 PM
To: sc-l at securecoding.org
Subject: [SC-L] Retrying exceptions - was 'Coding with errors in mind'

Pascal Meunier <pmeunier at cerias.net> wrote:
Tim Hollebeek <tholleb at teknowledge.com> wrote:
(2) in many languages, you can't retry or resume the faulting code.
    Exceptions are really far less useful in this case.

See above.  (Yes, Ruby supports retrying).

Bjorn Stroustrup discusses retrying exceptions in "Design and Evolution of
C++" (http://www.research.att.com/~bs/dne.html).  In particular, he
described one system where the language supported exceptions, and after some
number of years, a code review found that there was only one retryable
exception left - and IIRC the code review decided they were better off
without it.  How much are retryable exceptions really used, in Ruby or
anywhere else that supports them?

--
Jonathan Leffler (jleffler at us.ibm.com)
STSM, Informix Database Engineering, IBM Information Management Division
4100 Bohannon Drive, Menlo Park, CA 94025-1013
Tel: +1 650-926-6921     Tie-Line: 630-6921
          "I don't suffer from insanity; I enjoy every minute of it!"



_______________________________________________
Secure Coding mailing list (SC-L)
SC-L at securecoding.org
List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l
List charter available at - http://www.securecoding.org/list/charter.php




Current thread: