Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #4301

Re: Lilupophilupop

Show all headers | View raw

Am 2012-01-08 16:00, Jerry Stuckle meinte:
> On 1/8/2012 9:27 AM, Gregor Kofler wrote:
>> Am 2012-01-08 14:53, M. Strobel meinte:
>>> Am 07.01.2012 20:34, schrieb Gregor Kofler:
>>>> Am 2012-01-07 16:13, M. Strobel meinte:
>>>>> Am 07.01.2012 14:28, schrieb Gregor Kofler:
>>>>>> Am 2012-01-07 13:15, M. Strobel meinte:
>>>>>
>>>>>>> But it happens all the time. If you use tools/4GLs/CMSses you
>>>>>>> have to trust them, of course.
>>>>>>
>>>>>> How can I "trust" (or "mistrust") 4GLs?
>>>
>>> Believe that the software does what it is meant to.
>>> Are you going to ask what I think it is meant to, or what I thing
>>> you think it is meant to?
>>
>> A 4th generation language can have bugs and allow exploits, just like
>> 3rd generation languages. Despite the version upgrade, you still have to
>> write scripts or programs (and care about security issues, which arise
>> in the scope of your script). A CMS is a ready-to-use product, that
>> *should* take care of such issues and rule out any security issues in
>> the scope of the scripts of the application.
>>
> 
> Your reasoning is faulty.  A 4GL should rule out security issues in the
> scope of the language.  A CMS can also have bugs and allow exploits.

I can't see any difference to 3GLs. Take the mentioned CF. It allows to
define the data type of supplied arguments for function calls. It allows
intrinsic escaping of query strings. Both features *can* (and should) be
used, but it's not obligatory (and they are not "enabled" by some
default setting). Not doing can and will lead to injections. It's more
or less the same thing as with PHP.

> And even with a CMS you have to write your own scripts.

Pardon? You can, but you don't have to. No need to write scripts with
WordPress, Joomla!, Typo3, ...

> Also, CMS's have had any number of security problems over the years,
> even within their own scope.

Agreed. PHP-Nuke comes to my mind...

> I trust languages (even 4GL) much more than I do CMS's.

So do I.

Gregor

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 13:15 +0100
  Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 08:15 -0500
    Re: Lilupophilupop Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-07 18:27 +0100
      Re: Lilupophilupop "J.O. Aho" <user@example.net> - 2012-01-07 18:52 +0100
        Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 16:02 -0500
      Re: Lilupophilupop "Peter H. Coffin" <hellsop@ninehells.com> - 2012-01-10 18:31 -0600
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-11 09:29 +0100
          Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 08:42 -0500
          Re: Lilupophilupop Erwin Moller <erwinmollerusenet@xs4all.nl> - 2012-01-11 15:23 +0100
  Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 14:28 +0100
    Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 16:13 +0100
      Re: Lilupophilupop Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-01-07 18:03 +0100
      Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 20:34 +0100
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-08 14:53 +0100
          Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 15:27 +0100
            Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 10:00 -0500
              Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 18:29 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 15:49 -0500
                Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 22:59 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 17:38 -0500

csiph-web