Slashdot Mirror


What Makes a Programming Language Successful?

danielstoner writes "The article '13 reasons why Ruby, Python and the gang will push Java to die... of old age' makes an interesting analysis of the programming languages battling for a place in programmers' minds. What really makes a language popular? What really makes a language 'good'? What is success for a programming language? Can we say COBOL is a successful language? What about Ruby, Python, etc?"

45 of 1,119 comments (clear)

  1. Off the top of my head? by steeljaw · · Score: 4, Insightful

    Portability and scalability are what win it for me, I like to write my code once and it's got to be powerful enough to deliver a complex solution.

    --
    Procrastinators, Unite Tomorrow!!
    1. Re:Off the top of my head? by agrounds · · Score: 5, Insightful

      Portability and development speed are what drive it for me. Most of what I code is for log parsing, network device configuration, and reporting. To that end, I have never seen a need to look too far beyond Perl. It does everything I need with very minimal effort and development time, even for reasonably complex projects. Still, when Perl code becomes too large to work with effectively even after breaking down individual tasks, I change languages.

      I think the point is "which tool fits the current need best." Far too many people seem to want to use a hammer when a screwdriver would work better out of potentially misguided allegiances. Languages are no different than any other tool.

      I suspect TFA is more 'overrated' than 'insightful' since it makes some gross generalizations, cites search results as indicators of popularity, and completely neglects some of the nicer features of the popular scripting languages.

    2. Re:Off the top of my head? by SatanicPuppy · · Score: 5, Insightful

      Well, it's got a better object model than Java, and it's a lot faster to code with. Java just isn't appropriate in every situation.

      Python also plays well with C, so it's often used in concert with C for interfaces, etc.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    3. Re:Off the top of my head? by amccaf1 · · Score: 5, Insightful

      I'm mainly a C hacker, but I don't get why people would prefer Python over Java.
      I'm having similar questions, only wondering why people would prefer Ruby over Java. I've had to start learning Ruby for a variety of reasons so I've been reading Ruby tutorials off and on for a week or so.

      I don't think that Ruby is bad, not by a long shot. It's seems fairly decent and it doesn't seem to be lacking anything necessary. I'm just curious as to why someone would pick Ruby over some other language. I'm not quite understanding what the "killer app" of Ruby is. I'm not sure why this language had to be created.

      My understanding is that the main reason for choosing Ruby is to use it with Rails (which I have not looked at yet). And yet it's rare for me to read a good word about Ruby on Rails.

      Does anyone else get the impression that a lot of these newer languages are simply solutions that are looking for problems?
      --
      "Flag on the moon. How did it get there?"
    4. Re:Off the top of my head? by Dan667 · · Score: 3, Insightful

      I have always thought of computer languages as tools in the toolbox. After understanding the problem and coming up with a plan, the computer language I pick tends to be the best tool to do the job and require the least amount of effort to develop it. Need CAD speed? Use ANSI C. Need text processing? Use perl.

    5. Re:Off the top of my head? by ShieldW0lf · · Score: 5, Insightful

      The thing that makes a programming language successful is the existence of a large group of programmers who are familiar enough with the language to use it. That's pretty much it.

      If I can start a project in a particular language, get hit by a bus half way through, and finding someone else to sit in my seat and finish the project isn't a problem, then the language is a success. If I don't have that confidence, then the language is nothing but an interesting curiosity for academics.

      Pretty cut and dried.

      --
      -1 Uncomfortable Truth
    6. Re:Off the top of my head? by jcgf · · Score: 3, Insightful

      I hate any language that places significance on whitespace (if they would have just put a complex type into C we could have killed fortran before the 77 version and this Python shit wouldn't be here but alas).

      I also only find Monty Python mildly amusing at best (the jokes are funny but go on for too long and I'm growing tired of all the idiots that quote it all the time).

      Fact - C is the best language of all time. If your program is more than a few lines of bash it should be in C. Ritchie is God (yeah that's right, capital 'G') and Stroustrup should be shot for sacrilege!

      To mod troll or funny; that is the question. The thing is I'm not kidding.

    7. Re:Off the top of my head? by geekoid · · Score: 3, Insightful

      And the advantage of it being a sloppy maintenance nightmare developed by noobs.

      Where the hell do you get C and bloat together? If anything written in C has bloat, the developer should be promoted away from coding immediatly.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    8. Re:Off the top of my head? by OrangeTide · · Score: 4, Insightful

      People are quite capable doing quick things in Java without pulling in giant bloaty enterprise frameworks. Plus Python is bloat, I think it's like 40M+ installed.
      As for banging out quick projects, I tend to do them in C or shell scripts because I know they will either become real projects or they need to be understood by all.

      Also doing things in a scripting language and having C do the heavy lifting... sounds like Tcl, Lua, JavaScript. Python offers nothing new there.

      --
      “Common sense is not so common.” — Voltaire
    9. Re:Off the top of my head? by goombah99 · · Score: 3, Insightful

      I hate any language that places significance on whitespace I used to feel exactly the same way. Then I got used to it and man is it such a good idea. It not only is easy to scan, but it has the effect of making everyone's code look the same. That is, I can scan your code almost as easily as I can scan mine.

      Yaml does the same thing with whites space and the power of it is really evident when you compare it to JSON or XML. indeed you can put XML and JSON or HTML right into YAML without doing anything other than indenting it. No quoting, escapes, etc. so the other code looks "native" to the reader not encoded.

      So I totally understand your fear of it. But it's just not justified and you are missing out on a big deal in language enforced, clean coding style that pays big dividends.

      --
      Some drink at the fountain of knowledge. Others just gargle.
    10. Re:Off the top of my head? by AnomaliesAndrew · · Score: 5, Insightful

      I tend to agree with you that personal preference is one of the biggest factors in the choice of a language... but it's the strengths and weaknesses inherent in any language (or more so the language's purpose) that also shapes this. I rarely use only one language/model anymore.

      For instance, in my day to day life, I see a clear distinction as to when procedural/object oriented languages such as C, PHP, and Java should be used, and when a relational language like SQL should be used, and I rarely confuse those two classes of programming. Markup languages (though hardly programming languages) like HTML and CSS also have their essential and distinct roles. Were I forced to select only one, I'd probably quit programming!

      Programming languages are just tools to get the job done. When was the last time you saw a carpenter with only a chisel?

      Everybody's so quick to get into pissing matches.

      (Forgive any flawed terminology, I was just speaking casually.)

      --
      Move all sig!
    11. Re:Off the top of my head? by Yath · · Score: 3, Insightful
      Java is a fraction the complexity of C++. I understand that was one of its main missions - to be as powerful as, but easier to use, than C++.

      Ruby is an order of magnitude lower in complexity compared to C++. Whereas Java continues to mix objects and immediate values (e.g., int and Integer types), Ruby has only objects. Java's mixed model has a cost when programming. You may reply that the immediate int gives you a speed and optimization advantage, and that is true, but it misses the point. Java gave up speed compared to C++ to make things easier on programmers, and Ruby simply continues in that vein. You can't criticize Ruby for continuing what Java accomplished to a much lesser degree.

      There are numerous other examples - Ruby's iterators, for example, are a generation past what Java has to offer. You can find plenty to appreciate in Ruby vs. Java before you even start to talk about advanced language concepts like closures.

      Does anyone else get the impression that a lot of these newer languages are simply solutions that are looking for problems?


      I hear only complacency in the above comment. You've learned a language well, and find it hard to imagine a better way. Well, your lack of imagination does not equal evidence.
      --
      I always mod up spelling trolls.
    12. Re:Off the top of my head? by kellyb9 · · Score: 4, Insightful

      Java just isn't appropriate in every situation. No programming language is.
    13. Re:Off the top of my head? by emilper · · Score: 3, Insightful

      lambda (functions) - kinda old, like 50, 60 years, if I remember well

      Haskel suddenly very popular ? - the hordes of VB programmers got woken up to the world of threads

      Elbonia - you're late, now Elbonians ship spaghetti code back to the less muddy countries

      What makes programming languages popular ? - libraries ... now I'll shut up and go back improving my code spaghettizer ...

    14. Re:Off the top of my head? by fyngyrz · · Score: 3, Insightful

      C is perfectly capable of many of the most useful object oriented techniques. Objects with methods and locals, classes (instantiating objects from models), inheritance -- all of these are easily and efficiently implemented in C without library or compiler-generated overhead. All the while, the programmer can remain in complete control, and the application can remain fast and lightweight. You can't do everything; there are some object-oriented paradigms that don't fit, but frankly, they're not critical. The important parts are easily managed.

      --
      I've fallen off your lawn, and I can't get up.
    15. Re:Off the top of my head? by WGR · · Score: 4, Insightful

      Killer apps are overrated. Ruby is an expressive language, period. Studies have shown that software developers can only write a few lines of correct code per day. Making those lines count for as much as possible is important from a correctness, and a maintainability perspective. That implies that you should be programming in APL.

      There is much more to good programming languages than short code.

      This is one reason why C is a poor choice of application language You are under the mistaken impression that C is an application language. It is not. It is a system programing (high level assembler) language. That is why so much buggy code is written in C. It has none of the proper error checking built in to it that an application language should have. This provides the ability to get closer to the machine than other languages, but that is the role os system langages, not application languages.
  2. I don't really get the Java hate around here by JohnnyBGod · · Score: 5, Insightful

    Java's well organized, has a great standard library and is (mostly) consistent with itself. Its only problems, as far as I can see, was that it was initially slow and that it marketed itself as a web language, when there were better choices for that.

    Disclaimer: I've only coded in Java since 1.5.

    1. Re:I don't really get the Java hate around here by CastrTroy · · Score: 4, Insightful

      PHP is badly organized, has a long history of importing third party components for what should be included in the base, and is completely inconsistent with itself in many ways. Hasn't caused any problems in popularity for them. I would say by virtue of PHP and all the other popular languagues, that it should be easy to get started (free compilers and runtimes), that it should run on multiple platforms, and that it should be easy to install. Nothing gets you more popularity than millions of newbies trying your tool and being able to get it working that they continue to use it even when they get good, simply because it is what they are used to.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    2. Re:I don't really get the Java hate around here by Jack9 · · Score: 4, Insightful

      the fact that it can happen at all is unacceptable.

      Same with any interpreted language. PHP, Python, same problem if you are using deprecated accessors. Heck, even the MySQL connector worked differently in PHP3

      Are you really suggesting that every time there's a new version they change the name of the language? What about changing the name of every program you write just because you altered the API? Why would you say it's unacceptable?
      --

      Often wrong but never in doubt.
      I am Jack9.
      Everyone knows me.
    3. Re:I don't really get the Java hate around here by Chabil+Ha' · · Score: 4, Insightful

      ClassCastException and NPE are the easiest to avoid. With adequate unit testing, those are the easiest problems to find.

      While Generics add a lot of protection by making your List strongly typed, using instanceof checks will protect your code when using a List.

      --
      We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
    4. Re:I don't really get the Java hate around here by hesiod · · Score: 3, Insightful

      Dealing with specific libraries that usually only matter while creating the program itself (on the developer side) is completely different than requiring the end user of professional software to install one specific version of the client-side environment.

      And the point of software is the usage, not the creation. So dealing with issues during creation is the developer's problem. It needs to be usable by the client.

    5. Re:I don't really get the Java hate around here by Rary · · Score: 5, Insightful

      ... Which suggests that you haven't coded for very long.

      Actually, it suggests that he hasn't coded Java for very long.

      Regardless, if you're building a web application, you're probably not going to build it in Bash. The right tool for the job, and all that.

      It's silly to say "Language A is better than Language B". What makes more sense is "Language A is better than Language B at task X."

      Java is the right tool for many jobs. It'll die shortly after C dies (in other words, not anytime soon).

      --

      "You cannot simultaneously prevent and prepare for war." -- Albert Einstein

    6. Re:I don't really get the Java hate around here by JustinOpinion · · Score: 5, Insightful

      Agreed,a language being easy to install and start using can give it a huge boost in usage.

      I would also note that community can have a huge effect. Obviously the size of a community will have a strong effect on whether usage of the language remains, grows, or shrinks. After all, you are more likely to learn a language if you hear about it, if it's used in many other projects, etc.

      Additionally, community is important in terms of the amount of support you get. Languages with strong communities will have thousands of online tutorials, excellent forums that provide responsive help, freely available code snippets, plenty of libraries and add-ons, and so on. This kind of 'free support' is often more useful than even careful and exact core documentation.

      As a personal example, I (have to) use a programing environment called "Igor Pro" at work. The language syntax bothers me a bit--but on the other hand it is specialized to do some of the things we need it to. But what I really hate about it is the lack of community. When I Google for an answer to a problem I'm having, I get nothing. When I try to find a pre-made package for a non-core feature, it doesn't exist.

      Compare that to solving the same programming problem in, for example, Python. Even if it's not the optimal language, the fact that I get find tons of help online, and that there are so many community-developed packages and libraries, means that I can often solve the problem much faster.

      When evaluating new languages (and new software products), I always take the time to find out what the community is like. It can make all the difference.

    7. Re:I don't really get the Java hate around here by quanticle · · Score: 3, Insightful

      Dealing with specific libraries that usually only matter while creating the program itself (on the developer side)...

      Now that's nonsense if I've ever heard it. If that were true, Linux distros wouldn't need package managers.

      --
      We all know what to do, but we don't know how to get re-elected once we have done it
    8. Re:I don't really get the Java hate around here by Daniel+Dvorkin · · Score: 3, Insightful

      no.the.main.problem.with.java.is.the.length.of.the.class.path.you.have.to.type.to.do.anything();

      --
      The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
    9. Re:I don't really get the Java hate around here by Anonymous Coward · · Score: 4, Insightful

      I'm always surprised by people so vehemently blasting Java with an attached list of alternatives that includes Ruby. I like Ruby a lot, and use it and Java both on a daily basis, and I would say that yes, I prefer Ruby, but every language has its frustrations and Ruby's standard libraries pale in comparison with Java's. They are in places incomplete, inconsistent, and very often poorly documented, whereas Java has arguable *too much* completeness (to the point of bloat), few cases of inconsistency, and stellar documentation. A great language with an average standard library versus an average language with a great standard library? This is a close race, and very much up to individual choice.
       
      I don't have enough experience with the others on your list to vouch for them, but I often see Ruby on these lists and my experience with both doesn't bear it out.

    10. Re:I don't really get the Java hate around here by willyhill · · Score: 4, Insightful
      In more ways than one, PHP and MySQL are the Visual Basic and Access of the open source world.

      They're not very good (or weren't for a long time), they feel cobbled together at best. But they work. They're fast, have a low learning curve, they're accessible and essentially cheap and/or free. They're easy to deploy and shove into production fresh off the prototype phase.

      They have large numbers of people who use them as their primary tools. A large percentage of these people are not exactly what you'd call professional developers (I am not a developer, but I've worked closely with them throughout my career), yet they get "the thing" done somehow, and those systems tend to stay up there driving business for a long time.

      It's just funny that the very phenomenon that for years and years the platform and language purists argued was one of the Really Bad things about Windows is actually now coming to Linux in a big way. What those elitists never realized is that most developers just want to get the business of business done, cash a paycheck and go home to their families. They don't care that there are 19 different ways of escaping a string in the runtime library. No one cares about that, as long as the platform continues to deliver, even if it just sort of limps around.

      All those thousands and thousands of clueless VB/Access/VBA developers don't suddenly become little Donald Knuths because they're looking at a KDE desktop and using Emacs to code curly braces in PHP.

      --
      The twitter monologues. Click on my homepage and be amazed.
  3. Easy. by SatanicPuppy · · Score: 4, Insightful

    Power: What can it do?
    Performance: How fast can it do it?
    Ease of Development: How fast can quality code be turned out by regular programmers?

    Most modern languages fail on a couple of these. C is first class in Power and Performance, but it's not Easy. Ruby is okay in Power, and its very Easy, but it's slow. Java is Powerful, but doesn't match C for Performance, and it's not the quickest for development.

    I'm sure many fanboys will disagree with my analysis. They'll say "Regular programmers don't matter (C)" or "It's NOT SLOW (Ruby)" or "Development is too quick! (Java)".

    Really though, that's what it comes down to. The problem is, that there are unfortunate tradeoffs that have to be made. Most languages have a strength, but they all make sacrifices to be strong.

    --
    ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  4. Aging Engineers by avandesande · · Score: 4, Insightful

    I think many people fail to recognize that the average age of software engineers has gotten higher and that many have realized that most of the pitfalls in software development have little to do with the language chosen. I would rather concentrate on good engineering practices and refining familiar modules I have developed than learn a new language.

    --
    love is just extroverted narcissism
    1. Re:Aging Engineers by sheldon · · Score: 5, Insightful

      My father, just before he retired, got into a big argument with the kids. They had an embedded system, 32K onboard memory, everything was written in straight C.

      The kids wanted to do OOP. My father felt there wasn't enough memory to do this effectively and it was foolish.

      The reality was, that the kids just wanted to pretend they were doing OOP. They still used straight C, they just created structs and organized functions in files as if they were classes. It was actually rather clever and made it easier to maintain.

      It's hard as you get older, I think, you hear about some new idea as the silver bullet and your immediate reaction is negative because you've heard this so many times before. But you have to have an open mind, and watch and see what is happening.

      Otherwise you'll end up as a COBOL developer.

  5. From whose point of view? by mr_mischief · · Score: 5, Insightful

    Not to sound too much like Obi Wan, but many of the truths we cling to depend a great deal on our own point of view and all that.

    If I was working for O'Reilly, Manning, APress, Wiley, et al I'd say a successful programming language was one which sold lots of books.

    If I was a hiring manager for a large software company, I'd look closely at what language allowed the most cheap new grads to work together an produce something resembling quality code.

    If I was teaching intro to computer science, I'd worry about what was preparing my students for the rest of their education.

    If I was teaching a certificate-level course to people looking to get into the job market quickly, I'd look for the language with the highest placement rate.

    If I was a person of little clue, I'd go largely by the hype. Some would go with the mainstream hype, and some go with the counter cultural "that's the big hype, but our language is better" underdog hype.

    As a programmer, I prefer the language that helps me turn customer requirements into working programs that fastest with the least fuss on my part, and allows decent maintenance and customization later.

    As the owner of a small boutique programming shop, I want my expressive, powerful language to give me an advantage over others using less expressive languages. I'd like to find others who can use it, but a few is alright as I don't need a huge team to work on programs.

  6. Quck! by Anonymous Coward · · Score: 4, Insightful

    Every program on your screen and your OS was written in C/C++

  7. Java's not going to die by vivin · · Score: 5, Insightful

    I just started at a new job at the beginning of this year after quitting from my last job where I barely got to do any programming. The place where I work now is a Java shop. I was getting back to Java programming after a hiatus of a few years. For the last few years I mostly doing Perl with a smattering of C (PHP and Javascript on occasion). My experience with Java was mainly from college and a few odd projects I did here and there. The language had changed quite a bit over the last few years and to be honest, I surprised myself by being happy to get back to it (I had some sort of vague dislike for it for a period of time).

    The company sponsored a trip to JavaOne at San Francisco earlier this month, for the Dev Team. I also got to go. This was my first time at JavaOne. It was amazing, exciting, and I learnt a LOT of new stuff. The main thing I got from there was that Java, far from being a programming language, is also a platform. There are a lot of new things being built on TOP of Java. For example, Groovy, and JavaFX. Java now has excellent support and frameworks to roll your OWN domain-specific languages.

    Python and Ruby are not going to push Java out of the way. For example, you have mergers of Java with these languages (Jython and JRuby). Essentially you have Python and Ruby using Java resources and libraries. I think instead of "dying", Java is just going to evolve into a stable platform that lets you build stuff on top of it.

    --
    Vivin Suresh Paliath
    http://vivin.net

    I like
  8. What makes a programming language successful? by pokeyburro · · Score: 3, Insightful

    What makes a programming language successful?

    Same thing that makes a religion successful. Adherents.

    --
    Lately democracy seems to be based on the skybox, the Happy Meal box, the X-box, and the idiot box.
  9. Re:Ruby and Python are ex-parrots, not Java by Jaeph · · Score: 5, Insightful

    You didn't review any C either, yet we all know that the language is out there and being used. Same with perl.

    I think your field of work is too narrow to be completely explanatory.

    Btw, I do agree with your general point - I don't see python or ruby bumping aside java. But your personal experience, extensive as it appears, is not enough to derive that conclusion

    -Jeff

    P.S. I really wish java would go. I hate the upper/lower case thing in all the names.

    --
    Please learn the difference between a dissenting opinion and a troll before you moderate.
  10. Comment removed by account_deleted · · Score: 5, Insightful

    Comment removed based on user account deletion

  11. Re:Yes, sure, it is the evil gang... by hjf · · Score: 4, Insightful

    yeah, you know, 'cause when you have 50 programmers on a project, C l33tnesses like

    while (x-->0) { blah; }

    are so cool and easy to understand. and malloc()s make memory management so easy and cross-platform. and clustering is for wussies, if you need more than a core2duo on Linux, is because you're unl33t or because you need to do some routines in über-ELITE assembler.

    now when you program in Java you forget all that crap, you just code. need a bigger app? J2EE it and run it on a cluster. add nodes a needed to keep performance. node dies? no problem, J2EE takes care of it.

    migrated from mysql to Oracle or DB2? no problem, just let Hibernate know about it.

    tired of Windows Server and want to run opensolaris, linux or OS X Server? no problem, just drop your EAR/WAR on the new server and relax. it's working.

    wanna add more coders to your project? point 'em to the javadoc and let they read through the verbose (and thus self-explaining) code.

    strong typing is there to keep you from doing stupid things. you can always tell what the program IS going to do in all situations, because you HAVE to specify all situations.

    but you're too cool for java. lemme know when banks switch their systems to LAMP and we'll talk.

  12. Re:Ruby and Python are ex-parrots, not Java by Anonymous Coward · · Score: 5, Insightful


    Do you ever think that maybe your survey has a heavy self-selection bias? I mean it seems to me that the most likely candidates for security reviews would be applications that have been around long enough to have somebody in management say, "Hey, we need to have a third party review this!". This explains how FIVE PERCENT of your applications are COBOL while only "three" are PHP. By your analysis, it's as if C/C++ doesn't even exist...

  13. FFS by Pedrito · · Score: 3, Insightful

    Java isn't going to die any more than C. Nor will Python or Ruby die any time in the foreseeable future.

    Anyone can play Devil's Advocate and make one language look better than another from some point of view, but the fact is, different languages have their different pluses and minuses. I'm sure Ruby and Python have their pluses, but I don't see them being used NEARLY as much as Java. And take into consideration that Ruby has been around just as long as Java and Python has 4 years on both languages. If they were going to kick Java's ass, it would have happened by now.

    I suspect the article is wishful thinking (though I can't read it 'cause the site didn't survive this post). I don't know why people have to make such a big deal about this stuff anyway. Languages evolve and new languages and paradigms will be created in the future. Computer programming is still in its infancy. There's a good possibility that 20-30 years down the road, none of these languages will be around. They may be completely replaced by some far more powerful paradigm we can't even imagine yet.

    These kinds of predictions are old and pointless.

  14. Java Cannot be 100% Replaced by wigginz · · Score: 3, Insightful

    What's wrong with Java? Sure I can't slap together a web 2.0 site in 1 day like I could with .net 3.0 or Ruby, but they can't enable a high availability transactional based middle ware system. Java has so many great uses beyond simple web apps, it will always have a place in the enterprise and mobile devices.

    --
    You may find my appearance and demeanor foolish, but it is you who plays the fool.
  15. Re:Languages and technology stacks by Chemisor · · Score: 3, Insightful

    > And repeat smart things like not treating arrays as first-class entities?
    > Honestly, C is full of design errors.

    Come back when you know how the computer works, grasshopper. C doesn't treat arrays as "objects" because the computer doesn't do that. If you want higher level abstractions, use C++, where you have the nice vector class that does what you want.

  16. Re:Ruby and Python are ex-parrots, not Java by ajv · · Score: 3, Insightful

    It's not about the platform, language or the framework that makes an application safe, it's the security engineering that does. If you don't do any, your app WILL be insecure by design and there's no way you can't fix such code.

    However, you have a point to a degree - I am initially more productive reviewing frameworks I am familiar with. But that doesn't mean I would be ineffective at reviewing Python or Ruby. It would take me about half a day to spin up in any language or framework as I found things that are missing. And that's the important thing:

    I hate reviewing apps with zero security engineering. It's exactly like shooting fish in a barrel, but hopeless as you're not going to get a nice fish stew at the end.

    What I look for are meta-issues found in all languages and frameworks. Syntax and functions can be found in online references - if you need them.

    There is nothing special about any language as few protect against the security artifacts we look for.

    For example, if your code has an access control mechanism, I look at it in situ on a live test app, deciding how best I might attack it, and then research using the code how I can obviate it at different levels:

    * Coarse grained - is this feature access controlled at all? This is definitely a problem for J2EE apps that use servlets as folks think presentation level security is adequate. It's not
    * Medium grained - does this feature offer different levels of access based upon your role? If so, how does this mechanism work? What do I do to get around it and steal stuff?
    * Fine grained - does this feature restrict access to secured resources (direct object references)? If so, how does this mechanism work?

    Each of the things we look at are verifying security mechanisms. Knowledge of the language or framework is simply not necessary. If you know what you're doing, you can prove the lack of security engineering by testing the app in situ and then research why it fails. Once I find a weakness, I look at the code to see why the weakness exists. Once I've found the issue, I look further afield for the pattern and then I document the issue. Rarely does an app or framework have just one weakness - they are usually patterns.

    Picking up a new language or grammar and framework, like going from Struts to Spring MVC takes about half a day for someone like me who knows multiple languages, both functional like Haskell, or OO languages like Smalltalk or Ada, or scripting dynamic languages like PHP, Ruby or Python, or declarative languages like C or Java. We do not write the app, we are reviewing the app.

    Security mechanisms are usually fairly clear if they exist. If they do not make themselves immediately obvious, they are usually missing.

    Folks who have the hubris to think their code is somehow safe, like the COBOL folks on the mainframe or your example of not reviewing code if you don't know it well. That's why I turned down the Haskell review as I didn't know it well enough in the time available. If it was a longer review, I would have taken it as I love to learn new languages.

    However, fyi, if you paid me to be a developer, I could be immediately productive in the following languages:

    J2EE - Since Java was first released. Major frameworks include Struts, type 1 JSP with JSTL, Spring MVC, Struts 2.0, and JSF
    PHP - Since PHP 3 .NET (C# and VB.NET) since .NET 1.0

    Could code if absolutely required:

    COBOL - 12 months review only experience
    RPG - 12 months review only experience
    Perl - 15 years experience
    Shell scripts - 15 years experience
    Ruby with RoR - tested it out for a new version of my forum (UltimaBB/XMB) but it was too slow
    C - since 1985. Co-wrote the Matrox millennium driver for XFree86 back in the day
    C++ - since CFront was a bastard child
    Ada - since 1990. Still have fond memories
    Pascal - since 1985, haven't used it for a while

    Languages that I don't suck at but wouldn't claim any particular skills:

    --
    Andrew van der Stock
  17. There is Only 1 Rule: My Time is Important by SparafucileMan · · Score: 4, Insightful

    I'll take any language that can let me write, read, and understand as fast as the speed of computers is progressing, i.e., exponentially.

    I don't give a crap if language xxxxxxx is more efficient, more hardcore, etc. You know why?

    Because I don't want to spend a year writing an application in C for efficiency and find out at the end that for a mere $1,000 I could have written the same thing in Python in a month and just bought a faster computer 11 months later.

    YOUR time is linear, while the computer's is exponential. You'd be a fool to not take advantage of that and, frankly, type safety, efficiency, platform independence, programming style, power, etc. etc. can all go to hell. Just give me a beautiful language.

  18. COBOL a success? Why is this even a question? by sirwired · · Score: 4, Insightful

    I am completely confused as to how the author can even ask the question "Is COBOL a success?"

    Is COBOL old? Certainly.
    Is COBOL outdated? Yes.
    Has COBOL since been replaced by better languages? Yep.
    Would you be insane to start a new, large, application from scratch using COBOL? Of course.

    But "Is COBOL a success?" Without doubt, yes. Countless millions (perhaps) billions of lines of production COBOL code are still in use. It is still the core behind many of the applications that run our day-to-day lives. These applications have been running for decades with downtime records that would put an average "Web 2.0" app to shame.

    Certainly, IBM deserves a lot of credit for this, maintaining pure 100% backward compatibility for those apps for the last forty years or so, but some credit is due to the language itself.

    SirWired

  19. bloat vs big by MtHuurne · · Score: 4, Insightful

    Not every big library is bloated. It's only bloat if it has a poor size to functionality ratio.

    For example libc is small, but it does not include XML parsing, HTTP support, SHA1 and MD5 sums, the ability to read compressed files etc. Sure there are libraries for that, but you have to pick and add them yourself. So libc is small not because it is amazingly efficient, but because it is limited in scope.

    Personally, I like big standard libraries like Java and Python have. You pay for it in the initial install, but once that is in place, your application has access to a huge amount of functionality without having to add a lot of external dependencies.