I said, at the very beginning of this discussion, that language features can most certainly help with security. I pointed to automatic memory management as making buffer overflows a thing of the past.

The point I'm attempting to make is that you seem to be touting language features as the next step. That isn't the next step. We have language features in Perl for nearly every security hole out there. SQL Injection? DBI placeholders. XSS? Taint. And on and on. The problem is that they go unused.

Do you know the easiest way to break into a computer system? Just ask the person you want to break in as for their password. It's a 50-50 chance that they'll just give it to you if you pose as someone from the helpdesk. This goes for every single person in a company, CEO and CTO down. (Yes, CTO's have been caught by this, too.)

Do you know the most common source of corporate breakins? Disgruntled ex-employees.

Do you know the most common source of security holes in Perl CGI scripts? SQL injection and XSS, both of which have been solved by language features for years.

Except, you cannot force people to use placeholders for all variable substitution because of: 

my $sql = <<"__END_SQL__";
SELECT $obj->{name_col} AS name
      ,$obj->{val_col} AS value
  FROM $obj->{table_name}
 WHERE $obj->{id_col} = ?
__END_SQL__

[download]

Did I expose myself to a SQL injection? Can you prove either side? I couldn't, yet that kind of SQL is correctly all the time.

My criteria for good software:
  1. Does it work?
  2. Can someone else come in, make a change, and be reasonably certain no bugs were introduced?

In reply to Re^10: Attack on Perl or Perl's need better PR (again) by dragonchild
in thread Attack on Perl or Perl's need better PR (again) by wazoox

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.