RE: [SC-L] opinion, ACM Queue: Buffer Overrun Madness

2004-06-11 Thread David Crocker
I agree that converting legacy code to use one of the techniques I suggest isn't always going to be easy and inexpensive. My posting was aimed at those saying that something better than C/C++ should be used for new security-critical applications (which I agree is preferable), and I was pointing out

Re: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread Dana Epp
Ok, lets turn the tables a bit here. We talked about this a bit back last December when I said that you need to use the right tool for the right job, and to quit beating on C. For those of us who write kernel mode / ring0 code, what language are you suggesting we write in? Name a good typesafe

Re: [SC-L] opinion, ACM Queue: Buffer Overrun Madness

2004-06-11 Thread Crispin Cowan
David Crocker wrote: Apart from the obvious solution of choosing another language, there are at least two ways to avoid these problems in C++: 1. Ban arrays (to quote Marshall Cline's "C++ FAQ Lite", arrays are evil!). Use ... 2. If you really must have naked arrays, ban the use of indexing and ari

RE: [SC-L] opinion, ACM Queue: Buffer Overrun Madness

2004-06-11 Thread ljknews
At 10:36 PM +0100 6/10/04, David Crocker wrote: >I agree that converting legacy code to use one of the techniques I suggest isn't >always going to be easy and inexpensive. My posting was aimed at those saying >that something better than C/C++ should be used for new security-critical >applications (

Re: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread ljknews
At 2:00 PM -0700 6/10/04, Dana Epp wrote: >Ok, lets turn the tables a bit here. We talked about this a bit back last December >when I said that you need to use the right tool for the right job, and to quit >beating on C. > >For those of us who write kernel mode / ring0 code, what language are you

Re: [SC-L] opinion, ACM Queue: Buffer Overrun Madness

2004-06-11 Thread der Mouse
> What there are _not_ are reasons for new development to cling to > languages which make flawed constructs easy for the individual > programmer to misuse. Certainly there are - or people wouldn't be doing it. Whether you or I think those reasons are good reasons is another question. (Some of th

RE: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread Michael S Hines
Likewise for the IBM Mainframe operating systems MVS,OS/390,z/OS - much of which is written in (I believe) PL/M - a dialect much like PL/1. Many of our Operating Systems seem to have evolved out of the old DEC RSTS system. For example, CP/M had a PIP command. Later renamed to COPY in DOS. UNIX

Re: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread Crispin Cowan
ljknews wrote: At 2:00 PM -0700 6/10/04, Dana Epp wrote: Ok, lets turn the tables a bit here. We talked about this a bit back last December when I said that you need to use the right tool for the right job, and to quit beating on C. For those of us who write kernel mode / ring0 code, what lang

RE: [SC-L] opinion, ACM Queue: Buffer Overrun Madness

2004-06-11 Thread David Crocker
ljknews wrote: >> And there are ways of using Assembly Language to avoid pitfalls that it provides. There are ways of using horse-drawn carriages to avoid the major reason (think street cleaning) why the automobile was embraced in urban areas during the early part of the 20th century. What there

Re: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread der Mouse
> For those of us who write kernel mode / ring0 code, what language are > you suggesting we write in? Name a good typesafe language that you > have PRACTICALLY seen to write kernel mode code in. Lisp. I used Lisp Machines back when I worked in academia, and almost everything was in Lisp, includi

[SC-L] IBM OS Source Code

2004-06-11 Thread Michael S Hines
I was a bit wrong earlier.. IBM System Programming language was PL/X (not PL/M)... Here's a link to an older reference manual... http://www.bitsavers.org/pdf/ibm/360/pls/GC28-6794-0_PLSIIguideMay74.pdf Mike H. --- Michael S Hines [EMAIL PROTECTED]

RE: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread ljknews
At 9:16 AM -0500 6/11/04, Michael S Hines wrote: > IBM had Language Environment (LE) before .NET come along. What is Language Environment (for either of those) ?

Re: [SC-L] Interesting article on the adoption of Software Security

2004-06-11 Thread Crispin Cowan
Michael S Hines wrote: Likewise for the IBM Mainframe operating systems MVS,OS/390,z/OS - much of which is written in (I believe) PL/M - a dialect much like PL/1. If PL/M is the language I am remembering from an embedded systems class back in the 1980s, then it is not at all like PL/1. Rather,