Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Security of Popular Programming Languages

Posted by Soulskill on from the new-ways-to-argue-about-your-favorite-language dept.

An anonymous reader writes "Deciding which programming language to use is often based on considerations such as what the development team is most familiar with, what will generate code the fastest, or simply what will get the job done. How secure the language might be is simply an afterthought, which is usually too late. A new WhiteHat Security report approaches application security not from the standpoint of what risks exist on sites and applications once they have been pushed into production, but rather by examining how the languages themselves perform in the field. In doing so, we hope to elevate security considerations and deepen those conversations earlier in the decision process, which will ultimately lead to more secure websites and applications."

2 of 189 comments (clear)

  1. ASP? by BaronAaron · · Score: 5, Insightful

    Do they mean Classic ASP? They list .NET separately so I don't think they mean ASP.NET, but they also don't include ASP in their list of "legacy" languages. I also seriously doubt 16% of companies are still using Classic ASP.

    ASP isn't even a language, it's a framework. You can write a Classic ASP app in vbscript or javascript. You can write ASP.NET in any .NET supported language. Then there is ASP.NET MVC.

    If they can't get their list of tested "languages" straight, I doubt the rest of the article.

  2. Not a useful paper by MobyDisk · · Score: 5, Insightful

    In the wake of Heartbleed, one might think that this would be talking about array bounds checking or buffer overflow mitigation. No. It is talking about web site frameworks.

    examined the vulnerability assessment results of the more than 30,000 websites

    First of all: this is not measuring the security of the programming language. This is measuring the security of the OS infrastructure and toolchains. Notice C/C++ is not on the list, since it is hardly ever used for creating web sites.

    There was no significant difference between languages in examining the highest averages of vulnerabilities per slot.

    What the heck is a slot?

    Any summary where Perl scores the best must be deeply questioned. I doubt this is an apples-to-apples comparison. Surely these Perl sites are not doing nearly as much as the sites written in other languages.