Python secure?

Peter Hansen peter at engcorp.com
Mon Aug 16 01:48:38 EDT 2004


Reid Nichol wrote:

> Terry Reedy wrote:
> 
>> ... compiled C can be terribly insecure relative to
>> Python.  C has dangerous functions like strcpy() which, if used with
>> external input, can make a program subject to buffer overrun exploits 
>> that
>> can do explosive damage.
> 
> But this doesn't make C an insecure language.  No language is either 
> secure nor insecure.  It's what the programer does with it that matters.

New definition for the purposes of this discussion:

"secure language": a programming language which, by virtue of
its structure, libraries, syntax, runtime, or other features
supports and tends to encourage the creation of software which
doesn't have gross security holes".  Viz. "Python"

"unsecure language": a programming language which, by virtue
of its structure, primitive libraries, awkward syntax, non-
existent runtime, or other limitations tends to encourage
and lead to the creation of software with gross security
holes".  Viz. "C"

A given programmer will be more likely to create safe and
secure software using Python than with C, thereby making
C the less secure...

-Peter



More information about the Python-list mailing list