Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.forth > #56313

Re: can forth outdo java? for web and everything?

Show all headers | View raw

On 26/03/2017 0:41, Elizabeth D. Rather wrote:
> On 3/25/17 7:04 AM, Cecil Bayona wrote:

>> Java is such a complicated mess and it's supposed advantage in security
>> is a myth.
>>
>> Quite a few libraries with hundreds of entries to master.
>>
>> On the other hand Forth is simple but and a huge but there is no
>> security to speak of.
> 
> Security is best defined and pursued in the context of an application.
> Forth applications can be extremely secure...

Well, yes.  Any application in any language "can be" extremely secure.
But there are standard approaches which minimize the attack-surface.

For example: eliminating buffer overflows.  A substantial number of
hacks "in the wild" are due to forced buffer overflows.  Or for example,
accessing arbitrary memory addresses.

C (the majority implementation language for many years) and its ilk to
virtually nothing to help prevent such attacks.  Rather, the programmer
is cautioned to use X function rather than Y function, and is given an
entire litany of does and don'ts.

Forth is somewhat better, since strings (for instance) are addr,length
pairs (in most instances).  However, there's no way to know (other than
comments and perhaps naming conventions) whether an item is a buffer or
not, or whether it is 8 bytes or 8000 bytes long.

Higher-level languages generally prevent direct access to memory, and
enforce bounds-checking of access to buffers, specifically to prevent
such problems (and to make the programmer's life easier).

As an example, 8th does not allow direct memory access by de-referencing
an arbitrary number, while both C and Forth do (it's  easier to do so in
Forth, in fact).  So while that ability is sometimes needed in very
low-level code (drivers, etc), it is (almost?) never required in a
user-level application.  That latent ability is an Achilles Heel.

Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

can forth outdo java? for web and everything? gavino himself <jackvanc3@gmail.com> - 2017-03-24 21:22 -0700
  Re: can forth outdo java? for web and everything? Helmar Wodtke <helmwo@gmail.com> - 2017-03-25 08:12 -0700
  Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-25 20:00 +0300
    Re: can forth outdo java? for web and everything? Cecil Bayona <cbayona@cbayona.com> - 2017-03-25 12:04 -0500
      Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-25 21:08 +0300
      Re: can forth outdo java? for web and everything? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-25 11:41 -1000
        Re: can forth outdo java? for web and everything? Ron Aaron <rambamist@gmail.com> - 2017-03-26 06:53 +0300
          Re: can forth outdo java? for web and everything? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-25 18:13 -1000
            Security (was Re: can forth outdo java? for web and everything?) Ron Aaron <rambamist@gmail.com> - 2017-03-26 07:47 +0300
            Re: can forth outdo java? for web and everything? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-26 15:24 +0000
  Re: can forth outdo java? for web and everything? hughaguilar96@gmail.com - 2017-03-25 12:53 -0700
  Re: can forth outdo java? for web and everything? jean-pierre@buechi-schmitt.ch - 2017-03-26 02:01 -0700
  Re: can forth outdo java? for web and everything? gavino himself <jackvanc3@gmail.com> - 2017-03-29 21:43 -0700

csiph-web