Blame Bad Security on Sloppy Programming

CowboyRobot writes "ACM Queue has an article that blames security flaws on poor programming, rather than any inherent problems with particular languages. From the article: 'Remember Ada? ... we tried getting everyone to switch to a 'sandboxed' environment with Java in the late 1990s... Java worked so well, Microsoft responded with ActiveX, which bypasses security entirely by making it easy to blame the user for authorizing bad code to execute.'"

Comments

"Why fix broken code...

[tcopeland]

> ...if you can just shoot the message?"

So true. Thus the logo for PMD, a Java static analysis tool - "don't shoot the messenger".

Blame the Programmer?

[stinkyfingers]

I resemble that remark!

personally...

[Anonymous Coward]

I blame bad security on the Speak'n'Spell keyboards we have to use in this office.

Re:It is time

[stinkyfingers]

More methods to make lawyers rich? I'm torn.

Bad programming, huh?

[Anonymous Coward]

Fatal error: Call to undefined function: message_die() in /var/www/acmqueue.com/htdocs/db/db.php on line 88

Re:The human factor

[Anonymous Coward]

and a workload Hercules couldn't metaphorically shoulder.

You've got the wrong job. Try flipping burgers.

ACM Queue web server has mod_murphy's_law...

[MadRocketScientist]

Didn't even finish reading the article before:
Fatal error: Call to undefined function: message_die() in /var/www/acmqueue.com/htdocs/db/db.php on line 88

Great article

[sql*kitten]

Fatal error: Call to undefined function: message_die() in /var/www/acmqueue.com/htdocs/db/db.php on line 88

Seems some folk ought to practice what they preach, eh?

Not Black and White

[Doesn't_Comment_Code]

Depending on how skeptical you are today, you might think:

Really bad/inexperienced users write insecure code.

Good programmers write good,secure code.

Excellent programmers that work for companies that make a lot of money from support and updates write insecure code that is easy to fix.

Re:Uhh..

[aardvarkjoe]

Redundant it may be, but how many people were going to read the article or those like it before it got put on Slashdot.

Are you implying that anyone's going to read it now that it's been posted on Slashdot?

Re:about time

[Silvertre]

...and while you're at it, why not solve the halting problem as well.

Where in the world is my ActiveX?

[hummassa]

Ummm gosh, the only ActiveX applets I ever saw was right after it was released. Heh, I often say Java is dead on the web (though I know it isn't completely) but now ActiveX is entirely dead except for like the applet on Windows Update :-P

You are a Holy Person, sir/madam.

Go find some pr0n and you'll see a lot of activeX thingies trying to install. Lucky me I use Moz.

Re:The human factor

[Paladine97]

I think I see your problem. You should become Atlas instead of Hercules! I hear he can bear more on his shoulders...

Re:Uhh..

[__aagmrb7289]

Fact is, if it's an operating system written by anyone but Microsoft, it's more secure than Microsoft's. If you are bored, we can make up some reasons as to why this is so. (sarcasm implied, but hell, I know ya'all will miss it)

Re:Blame the Specs and Time.

[Cecil]

Oh look! A co-worker! How's it going?

Re:Uhh..

[fatphil]

I'm sure I'm not the only one who's learnt that:

Fatal error: Call to undefined function: message_die() in /var/www/acmqueue.com/htdocs/db/db.php on line 88

is indicative of bad programming. Thanks ACM Queue for an enlightening 2-line article!

FP.

Re:I only read the first page...

[clamatius]

Ok, it's time for me to own up. I'm the one creating all the bugs you're talking about.

Acne? Bug in face.cpp.
Flat tires? You guessed it, tire.cpp, line 5572.
Girls who say no? That's not a bug, it's a feature.