<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">So it's not Pyhton itself, but the fact that it is interpreted into something above assembly code, when is then converted to machine code, leaving you with the inability to map one line of Python code to its assembly code (== verifiable) equivalent?<br>
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">So this would theoretically apply to Java, had it not been built with the security checks it has (albeit they may fail to be correct)?<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Oct 27, 2013 at 10:22 AM, Michael B. Trausch <span dir="ltr"><<a href="mailto:mbt@naunetcorp.com" target="_blank">mbt@naunetcorp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="im">
<div>On 10/27/2013 10:00 AM, Pete Hardie
wrote:<br>
</div>
<blockquote type="cite">
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
Out of curiosity, what sort of things are you referring to in
the Python stdlib?</div>
</blockquote>
<br></div>
It's not "what sort" but "how much".<br>
<br>
It's extremely time-consuming and thus therefore very improbable to
be able to audit the entire Python stdlib, plus the entire python
VM, plus the entire interpreter, plus the generator, and be able to
say "Yes, this 12-line Python program is proved secure."<br>
<br>
Those twelve lines on their own might be secure, <i>assuming that
all invariants are held that the programmer assumes</i>. Of
course, that depends on far more than the 12 lines of code! That
audit then has a domino effect.<br>
<br>
However, if you are working in C, you don't even really need to
worry about the compiler itself, just the compiler's output. If you
can easily map a line of C to one or more assembler statements (and
you can do that quite easily), then you can prove the program's
security far more easily. After all, then you KNOW where the chains
of logic go—they're static, not dynamic.<br>
<br>
— Mike<span class="HOEnZb"><font color="#888888"><br>
<br>
</font></span><div><span class="HOEnZb"><font color="#888888">-- <br>
</font></span><span class="HOEnZb"><font color="#888888">
</font></span><span class="HOEnZb"><font color="#888888">
</font></span><span class="HOEnZb"><font color="#888888">
</font></span><table border="0"><tbody><tr><td> <img src="cid:part1.01050304.05090706@naunetcorp.com" alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <b>Naunet Corporation</b><br>
☎ <a href="tel:%28678%29%20287-0693%20x130" value="+16782870693" target="_blank">(678) 287-0693 x130</a> or (855) NAUNET-1 x130<br>
FAX: <a href="tel:%28678%29%20783-7843" value="+16787837843" target="_blank">(678) 783-7843</a><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Pete Hardie<br>--------<br>Better Living Through Bitmaps
</div></div>