Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 08 Oct 2014 20:11:43 -0400 (EDT)
From: "David A. Wheeler" <>
To: "oss-security" <>
Subject: Re: Thoughts on Shellshock and beyond

On Wed, 8 Oct 2014 14:53:44 -0700, Tracy Reed <> wrote:
> While it is too late for our hardware etc. perhaps strong type systems such as
> found in Haskell can help here?

No.  At least not in the sense of totally separating data and code.
It's trivial to implement a language (say Lisp) inside Haskell,
and then hand data to that implementation to be executed.

That does not make Haskell *bad*; you can implement an interpreter
in any Turing-complete language.  And it's absurd to say "NEVER
mix data and code" - it's sometimes the right approach to use.
But mixing code with data is probably an *overused* approach,
given the risks that come with it.

We need to help developers know what is safe, and what is less safe.
Then they can avoid easily-avoided problems, and know when they have
extra work to do.

--- David A. Wheeler

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.