Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141008215343.GZ22696@tracyreed.org>
Date: Wed, 8 Oct 2014 14:53:44 -0700
From: Tracy Reed <treed@...raviolet.org>
To: oss-security@...ts.openwall.com
Subject: Re: Thoughts on Shellshock and beyond

On Wed, Oct 08, 2014 at 02:39:23PM PDT, David A. Wheeler spake thusly:
> If there was some ironclad rule that "data and code must be totally isolated
> at all times" then I agree it's absurdly impractical.  Compilers

While it is too late for our hardware etc. perhaps strong type systems such as
found in Haskell can help here? It is known to be very good at avoiding
undefined or unexpected runtime behavior. Too late also for current languages
to have this bolted on but if anyone wanted to write "secure" software I'd be
looking at languages which provide some more guarantees. Too late for bash
also, of course which I suppose points us back at the original problem.

-- 
Tracy Reed

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.