Re: RISKS: Princeton discovers another Netscape security flaw
ses @ tipper.oit.unc.edu (Simon Spero wrote:
A pound to a bucket of ferrets this is another visit from our good friends Capt. Overrun and the static buffers, in which case it's more an indictment of C
So? I agree that it's essentially impossible to write reliable code in C, just as in assembly language. Actually, it's easier in assembly language because then you KNOW you have to do all the work yourself, while C misleads you into thinking it does some of the work for you when in fact it does not. That doesn't affect the point at all, though. The job of doing something like what Java claims to do correctly is basically equivalent to the job of creating an A2 grade operating system. (Don't bother looking for any, as far as I know the designation A2 doesn't even exist anymore because it is still beyond the state of the art. It means "verified implementation", i.e., the implementation -- not just the design as in in A1 -- is provably correct. Note that a strict interpretation of this would involve holding not just the code itself but also the tools that act on it -- like compilers, and microcode in machines that have it -- to A2 standards. If you wonder why, consider the famous Unix login hack from many years ago that involved a hack in the C compiler.) paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning@isd.3com.com or paul_koning@3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "The only purpose for which power can be rightfully exercised over ! any member of a civilized community, against his will, is to prevent ! harm to others. His own good, either physical or moral, is not ! a sufficient warrant." -- John Stuart Mill, "On Liberty" 1859
On 25 Mar 1996 Paul_Koning/US/3Com%3COM@smtp1.isd.3com.com wrote:
The job of doing something like what Java claims to do correctly is basically equivalent to the job of creating an A2 grade operating system.
I'm not totally convinced that creating an A* implementation of the java VM is impossible; the vm instructions are simple enough to define the necessary abstract interpretations over, and denotational semantics of,with a reasonable degree of confidence. I'd definitely rather right a trusted application in java than in C Simon --- They say in online country So which side are you on boys There is no middle way Which side are you on You'll either be a Usenet man Which side are you on boys Or a thug for the CDA Which side are you on? National Union of Computer Operatives; Hackers, local 37 APL-CPIO
On 25 Mar 1996 Paul_Koning/US/3Com%3COM@smtp1.isd.3com.com wrote:
ses @ tipper.oit.unc.edu (Simon Spero wrote:
A pound to a bucket of ferrets this is another visit from our good friends Capt. Overrun and the static buffers, in which case it's more an indictment of C
So? I agree that it's essentially impossible to write reliable code in C, just as in assembly language. Actually, it's easier in assembly language because then you KNOW you have to do all the work yourself, while C misleads you into thinking it does some of the work for you when in fact it does not.
Well, what would you suggest then ? Some mental masturbation like C++ ? <end religious jab> :-) I have found over the years, that C, just like anything other language, has it's quirks and foibles. malloc() calloc() alloc() and realloc() are known problems that go way back to the early days on the DEC; not to mention odd sized structure members can cause phase errors during compilation that never show until runtime.
That doesn't affect the point at all, though.
The job of doing something like what Java claims to do correctly is basically equivalent to the job of creating an A2 grade operating system. (Don't bother looking for any, as far as I know the designation A2 doesn't even exist anymore because it is still beyond the state of the art. It means "verified implementation", i.e., the implementation -- not just the design as in in A1 -- is provably correct. Note that a strict interpretation of this would involve holding not just the code itself but also the tools that act on it -- like compilers, and microcode in machines that have it -- to A2 standards. If you wonder why, consider the famous Unix login hack from many years ago that involved a hack in the C compiler.)
paul
I will agree with you here. What I mildly take issue with is that the C compiler shoulders the blame for faults that lie in the libraries and OS - just to start pointing fingers. DOS is famous for it's lack of system integrity when it comes to file and memory management - yet the standard library can do no more than what the target OS allows to take place. Thus the language get's blamed for shortcommings in an environment. Also, consider that many applications these days are built using third part support. Now we have the added dimension of someone else's code on top of our own, plus the compiler, plus the libraries, plus the OS. It's not a pretty picture, especially since we trust "packaged goods" too much. C itself is only composed of some 28 keywords, plus some extensions and a simple grammer. I personally will trust the the compiler first before I would trust the libraries linked, just based upon the simplicity of the language - failing some glaring error in the parser.
!----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning@isd.3com.com or paul_koning@3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "The only purpose for which power can be rightfully exercised over ! any member of a civilized community, against his will, is to prevent ! harm to others. His own good, either physical or moral, is not ! a sufficient warrant." -- John Stuart Mill, "On Liberty" 1859
...Paul ------------------------------------------------------------------------- "Faced with the choice between changing one's mind and proving that there is no need to do so, almost everybody gets busy on the proof" -- John Kenneth Galbraith "Success is attending a funeral as a spectator" -- E. BonAnno -------------------------------------------------------------------------
participants (3)
-
Paul S. Penrod -
Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com -
Simon Spero