Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery
 
PerlMonks  

Re: How to answer "Perl is not secure" objections?

by mr_mischief (Monsignor)
on Sep 06, 2007 at 19:50 UTC ( #637517=note: print w/ replies, xml ) Need Help??


in reply to How to answer "Perl is not secure" objections?

Perl, as a language, is much more secure than C or any other language that can have buffer overruns. http://www.computeruser.com/articles/2202,5,36,1,0201,03.html is a magazine article on buffer overruns and mentions Perl and Java as technologies to use to avoid the whole class of issues.

CERT's advisories page lists 31 advisories that in some way mention Perl. It has 2 for C#, 13 for Visual Basic, 56 for IIS, and 65 for Apache. Guess what? Nearly all of the Perl mentions are example exploits written in Perl of security issues in other projects. So you're seeing far fewer security advisories for your language than for the platform you'll be using to serve it. That should give some perspective.

.NET is not a convenient search term for CERT's database. Over at SecurityFocus, on the search by vendor page http://www.securityfocus.com/bid, Microsoft's .NET framework has 16 vulnerabilities listed as far back as 2002, with only two marked as 'retired'. To be fair, many of these only list past versions, but still have not been retired. Some of them are as new as July. Perl 5.8.0 from the perl5porters has 0.

On the BugTraq archive, I currently see no reference to Perl in the most recent five pages. PHP is the only language I noticed, with 5 vulnerabilities listed on page 1. The Linux kernel, vim, emacs, tar, OpenBSD, VMWare, Kerberos, postfix, and Thunderbird make the five most recent pages. Again, your programming language of choice has better numbers than the platform you'd use to host the code.


Comment on Re: How to answer "Perl is not secure" objections?

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://637517]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others browsing the Monastery: (9)
As of 2014-10-23 20:59 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    For retirement, I am banking on:










    Results (129 votes), past polls