Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 9 Oct 2014 10:34:49 -0700
From: Tracy Reed <>
Subject: Re: Thoughts on Shellshock and beyond

On Wed, Oct 08, 2014 at 05:11:43PM PDT, David A. Wheeler spake thusly:
> It's trivial to implement a language (say Lisp) inside Haskell,
> and then hand data to that implementation to be executed.

Sure, but at least with Haskell (and the like) you have to make it very
explicit that this is what you want to do. A lot of our problems seem to come
from the mixing happening by accident.

> But mixing code with data is probably an *overused* approach,
> given the risks that come with it.

Right. Which is why it should be a little more work to do and require that it
be made explicit that the mixing is what is intended.

> We need to help developers know what is safe, and what is less safe.
> Then they can avoid easily-avoided problems, and know when they have
> extra work to do.

Educating developers will be equally hard as switching to safer languages but
at least it is something people will stomache getting started on.

Tracy Reed, RHCE     Digital signature attached for your safety.
Copilotco            PCI/HIPAA/SOX Compliant Secure Hosting
866-MY-COPILOT x101

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.