Re: How to answer "Perl is not secure" objections?

[mr_mischief]

Perl, as a language, is much more secure than C or any other language that can have buffer overruns. http://www.computeruser.com/articles/2202,5,36,1,0201,03.html is a magazine article on buffer overruns and mentions Perl and Java as technologies to use to avoid the whole class of issues.

CERT's advisories page lists 31 advisories that in some way mention Perl. It has 2 for C#, 13 for Visual Basic, 56 for IIS, and 65 for Apache. Guess what? Nearly all of the Perl mentions are example exploits written in Perl of security issues in other projects. So you're seeing far fewer security advisories for your language than for the platform you'll be using to serve it. That should give some perspective.

.NET is not a convenient search term for CERT's database. Over at SecurityFocus, on the search by vendor page http://www.securityfocus.com/bid, Microsoft's .NET framework has 16 vulnerabilities listed as far back as 2002, with only two marked as 'retired'. To be fair, many of these only list past versions, but still have not been retired. Some of them are as new as July. Perl 5.8.0 from the perl5porters has 0.

On the BugTraq archive, I currently see no reference to Perl in the most recent five pages. PHP is the only language I noticed, with 5 vulnerabilities listed on page 1. The Linux kernel, vim, emacs, tar, OpenBSD, VMWare, Kerberos, postfix, and Thunderbird make the five most recent pages. Again, your programming language of choice has better numbers than the platform you'd use to host the code.