Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw

Re: How to answer "Perl is not secure" objections?

by mr_mischief (Monsignor)
on Sep 06, 2007 at 19:50 UTC ( #637517=note: print w/replies, xml ) Need Help??

in reply to How to answer "Perl is not secure" objections?

Perl, as a language, is much more secure than C or any other language that can have buffer overruns.,5,36,1,0201,03.html is a magazine article on buffer overruns and mentions Perl and Java as technologies to use to avoid the whole class of issues.

CERT's advisories page lists 31 advisories that in some way mention Perl. It has 2 for C#, 13 for Visual Basic, 56 for IIS, and 65 for Apache. Guess what? Nearly all of the Perl mentions are example exploits written in Perl of security issues in other projects. So you're seeing far fewer security advisories for your language than for the platform you'll be using to serve it. That should give some perspective.

.NET is not a convenient search term for CERT's database. Over at SecurityFocus, on the search by vendor page, Microsoft's .NET framework has 16 vulnerabilities listed as far back as 2002, with only two marked as 'retired'. To be fair, many of these only list past versions, but still have not been retired. Some of them are as new as July. Perl 5.8.0 from the perl5porters has 0.

On the BugTraq archive, I currently see no reference to Perl in the most recent five pages. PHP is the only language I noticed, with 5 vulnerabilities listed on page 1. The Linux kernel, vim, emacs, tar, OpenBSD, VMWare, Kerberos, postfix, and Thunderbird make the five most recent pages. Again, your programming language of choice has better numbers than the platform you'd use to host the code.

  • Comment on Re: How to answer "Perl is not secure" objections?

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://637517]
[Corion]: marto: Heh ;) You're just further enabling their lazyness :-D
[marto]: they still don't know there was a problem, nobody told them! :P
[Corion]: marto: Ow! I would assume there is a cron job monitoring the free disk space and automatically opening a ticket at 90%, 95% and 100% usage...
[Corion]: Even we had automatic emails back when we maintained the machine ourselves...
[marto]: Corion you under estimate how lazy these admins are :P
[Discipulus]: we too; using opsview alarms
[marto]: the key word: outsourcing ;)

How do I use this? | Other CB clients
Other Users?
Others chilling in the Monastery: (10)
As of 2017-01-24 10:06 GMT
Find Nodes?
    Voting Booth?
    Do you watch meteor showers?

    Results (203 votes). Check out past polls.