<div dir="ltr">Dan:<div><br></div><div>I mostly agree with what you are saying. However there is one point in much of this discussion that may not be covered.</div><div><br></div><div><font color="#a64d79"><span style="font-family:arial,sans-serif;font-size:13px">Further, assertions that compiler writers of language A tend to write compilers (or, in this case, standard libraries) that aren't safe in some way while writers of compilers for language B write systems that are is, frankly, self-congratulatory naval gazing.</span><br>
</font></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">There is a fundamental practical difference between C and Lisp that is relevant in the security world. That is of the vast number of explicitly undefined behaviors that are in the specification of C. This is pretty much unmatched in Lisp or C# or Java. John Reghur at </span><font face="arial, sans-serif"><a href="http://blog.regehr.org/">http://blog.regehr.org/</a> has done some fascinating work not only about undefined behaviors of C, but also of the substantial number of bugs in compilers.</font></div>
<div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif">And while what you say is true about dependencies on other libraries (this is always a major item we check for when doing assessments) is a risk for all systems (except for qmail), a significant fraction of all breaches are a result of logic errors or configuration errors. These errors compromise all systems equally, regardless of the language underneath.</font></div>
<div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif">wglb</font></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Apr 27, 2014 at 10:20 AM, Dan Cross <span dir="ltr"><<a href="mailto:crossd@gmail.com" target="_blank">crossd@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="">On Sun, Apr 27, 2014 at 4:27 AM, Steve Haflich <span dir="ltr"><<a href="mailto:shaflich@gmail.com" target="_blank">shaflich@gmail.com</a>></span> wrote:<br>
</div><div class="gmail_extra"><div class="gmail_quote"><div class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I agree with essentially everything in wglb's message, but (once again) I'll grumpily jump in to emphasize a point which I think many on this list have missed.<div class="gmail_extra">
<br><div class="gmail_quote"><div>
On Fri, Apr 25, 2014 at 1:20 PM, William Lederer <span dir="ltr"><<a href="mailto:william.lederer@gmail.com" target="_blank">william.lederer@gmail.com</a>></span> wrote:<br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div><br></div><div>I agree with the general sentiment that Lisp is a much safer language to build anything in. While several in this thread are pointing to bounds checking as one of the advantages that Lisp has over C and other languages, there is something else I find that is also very strong: It is easier to write programs about which a reader can reason about correctness. In Lisp, the programs tend to be closer to provable and errors are more evident. As in "obviously no deficiencies" vs "no obvious deficiencies".</div>
<div><br></div><div>But in my experience, vulnerabilities result from</div><div><ul><li>Buffer Overflows/lack of bounds checking (Heartbleed and friends)</li><li>Configuration errors</li><li>Logic Flaws</li><li>Dangerous use of user input (leading to SQLi, XSS, XSRF)</li>
<li>Improper use of cryptography</li><li>Unclear protocol specification (leading to OpenSSL)</li></ul></div></div></blockquote></div><div>This (IMO entirely worthy and correct) summary can easily be misunderstood! Lisp may be superior because it has bounds checking. (We've previously agreed that isn't guaranteed since it isn't in the ANS, and in any platform likely depends on optimization qualities, including the optimization qualities under which internal called routines were compiled.) But bugs based on buffer overflow don't on normal operating systems in general involve bounds checking. At some point on any modern OS, reading or writing to a socket stream will involve passing to the OS (generally via a thin user-mode C API layer like *nix read() and write(), or some socket analogue). Neither Lisp nor C will provide any automatic bounds checking on such a call. The OS treats the application's address space as a mostly-contiguous undifferentiated sea of bytes(*). It doesn't matter that at the app level C also has this model of a sea of bytes, while in Lisp the ocean is run-time tagged into small plots. That distinction disappears once one calls write(fd,buf,len).</div>
</div></div></div></blockquote><div><br></div></div><div>This is essentially the point I made in my email on April 13; an application program these days (even one written in Lisp) necessarily depends on a large set of libraries and support software that the application programmer has little to no control over. Naive pronouncements that we should simply write all our code in Lisp (or another "safer" language) are almost guaranteed to have limited effect because many security problems are manifest in code we depend on that is simply out of our control. Rebuilding the entire ecosystem that our applications sit on is economically infeasible and still leaves us open to the possibility of security problems in the underlying hardware (which have been shown to be real and to have been recently exploited). This in no way implies that we should not STRIVE to do better, but illustrates that the issue is more complicated than language A vs language B.</div>
<div><br></div><div>Further, assertions that compiler writers of language A tend to write compilers (or, in this case, standard libraries) that aren't safe in some way while writers of compilers for language B write systems that are is, frankly, self-congratulatory naval gazing.</div>
<div class="">
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>The Lisp Machine in its several manifestations might be the only counterexample,</div>
</div></div></div></blockquote><div><br></div></div><div>This, however, I disagree with. There are operating systems that deal solely with managed-code objects. If one considers, e.g., IL to be the "hardware" that sits on top of the underlying native instruction set acting as microcode, then Microsoft's Singularity system could be described as approximately equivalent to a Lisp machine in this regard.</div>
<div class="">
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> since there was no C boundary over which to cross, and because type and bounds checking was performed for free in the microcode. But Lisp machines aren't around any more largely because of the economy of scale. The number of x86 and x64 processors on the planet must be nearly on the order of 10^9, while the number of Lisp machine processors never got out of the 10^5 range, so Intel and AMD etc. could justify huge investments making those processors 3 orders of magnitude faster in raw speed. Lisp processors could not have kept up at bearable per-item cost. Alas!</div>
<div><br></div><div>It is certainly true that the Heartbleed bug resulted from an insufficiently-cautious implementation of an (overly?)complex specification. The author of the bug has essentially agreed with this analysis. But the "bounds checking" of most Lisp implementations would provide no protection against this failure (about which the original posting agrees) unless the succinctness and superior clarity of CL vs C code might help it be seen. That's a thin thread on which to hang an entire language argument.</div>
</div></div></div></blockquote><div><br></div></div><div>Actually, I'm not sure about that; in this case, the boundary violation was real and due to not taking into account the length of the input (e.g., one memcpy'd more than had been provided, reading off the end of the source buffer). But it was a rookie C programmer mistake, and I agree that this is indeed scant ammunition in a language beef.</div>
<div class="">
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>(*) I originally saw this beautiful metaphor, that C treats memory as an undifferentiated sea of bytes, on some discussion list but can't remember the originator. Google shows current use scattered over many programming subjects, but doesnt identify the original. Anyway, it is the reason that a small hyper-efficient C-struct-in-Lisp defining macro I wrote for a certain huge CL software product is named "define-sea-struct" and (I used to be a sailor) the operator for computing offsets possibly through multiple levels of nested structs is called "following-sea". Paradoxically, <a href="http://www.ibiblio.org/hyperwar/NHC/fairwinds.htm" target="_blank">http://www.ibiblio.org/hyperwar/NHC/fairwinds.htm</a> says "following seas" means "SAFE journey, good fortune" [emphasis added].</div>
</div></div></div></blockquote></div></div><br></div><div class="gmail_extra">Semper Fi.</div><div class="gmail_extra"><br></div><div class="gmail_extra"> - Dan C.</div><div class="gmail_extra"><br></div></div>
<br>_______________________________________________<br>
pro mailing list<br>
<a href="mailto:pro@common-lisp.net">pro@common-lisp.net</a><br>
<a href="http://common-lisp.net/cgi-bin/mailman/listinfo/pro" target="_blank">http://common-lisp.net/cgi-bin/mailman/listinfo/pro</a><br>
<br></blockquote></div><br></div>