Re: Q: type ... is new String

[Georg Bauhaus <rm.dash-bauhaus@futureapps.de>]

On 04.06.12 15:36, Maciej Sobczak wrote:

> I agree that most of the security problems that
> plague the web-development ecosystem could be solved with a proper
> type system and static type-safety.

To illustrate a problem, web programming is almost always confronting
I/O of untyped "text": of implicit, ambiguous, indeterminable,
inconsistent, wrong encoding. There is no perfect way to prevent
exception raising effects, remember that most systems are layered,
and disconnected. Basic AI is needed to make educated guesses about
to the meaning of octet sequences.

Any complaint about malformed output at the other end is likely
justified, but useless: "We *must* have the data. Do your best!"

The best one can do is classify I/O, then read input from sources
marked safe/unsafe, and finally use these data in typed structures.

Any countermeasure must be one of the masses: how can one make the
notion of type checking of web data so popular that it is considered
a must-have?