<p dir="ltr">Sounds to me that the various scripting interpreters need a solid mapping audit to better define input command to output machine code.</p>
<p dir="ltr">That said, ANY language that is compiled OR interpreted is subject to some level of transformation in order to be used by the machine. Thus php is a crap shoot not because of the language per se but because of its sloppy interpreter. There's all kinds of crap that will compile from C into bad code but not as much. As C is so much closer to the hardware, it is more limited in its allowable slop. Scripting languages are at least 3 steps away from what compiled C code runs in. </p>
<p dir="ltr">Fun and madness.</p>
<div class="gmail_quote">On Oct 27, 2013 10:25 AM, "Michael B. Trausch" <<a href="mailto:mbt@naunetcorp.com">mbt@naunetcorp.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div>On 10/27/2013 10:00 AM, Pete Hardie
wrote:<br>
</div>
<blockquote type="cite">
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">
Out of curiosity, what sort of things are you referring to in
the Python stdlib?</div>
</blockquote>
<br>
It's not "what sort" but "how much".<br>
<br>
It's extremely time-consuming and thus therefore very improbable to
be able to audit the entire Python stdlib, plus the entire python
VM, plus the entire interpreter, plus the generator, and be able to
say "Yes, this 12-line Python program is proved secure."<br>
<br>
Those twelve lines on their own might be secure, <i>assuming that
all invariants are held that the programmer assumes</i>. Of
course, that depends on far more than the 12 lines of code! That
audit then has a domino effect.<br>
<br>
However, if you are working in C, you don't even really need to
worry about the compiler itself, just the compiler's output. If you
can easily map a line of C to one or more assembler statements (and
you can do that quite easily), then you can prove the program's
security far more easily. After all, then you KNOW where the chains
of logic go—they're static, not dynamic.<br>
<br>
— Mike<br>
<br>
<div>-- <br>
<table border="0">
<tbody>
<tr>
<td> <img src="cid:part1.01050304.05090706@naunetcorp.com" alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <strong>Naunet Corporation</strong><br>
☎ <a href="tel:%28678%29%20287-0693%20x130" value="+16782870693" target="_blank">(678) 287-0693 x130</a> or (855) NAUNET-1 x130<br>
FAX: <a href="tel:%28678%29%20783-7843" value="+16787837843" target="_blank">(678) 783-7843</a><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div>