From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=0.4 required=5.0 tests=BAYES_00,FORGED_MUA_MOZILLA
	autolearn=no autolearn_force=no version=3.4.4
X-Google-Thread: 103376,ac4955b8006bd13c
X-Google-NewGroupId: yes
X-Google-Attributes: gida07f3367d7,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.68.196.232 with SMTP id ip8mr10734820pbc.6.1338821921235;
        Mon, 04 Jun 2012 07:58:41 -0700 (PDT)
Path: 
 l9ni20400pbj.0!nntp.google.com!news1.google.com!goblin2!goblin.stu.neva.ru!news.internetdienste.de!news.tu-darmstadt.de!news.belwue.de!newsfeed.arcor.de!newsspool4.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Date: Mon, 04 Jun 2012 16:58:38 +0200
From: Georg Bauhaus <rm.dash-bauhaus@futureapps.de>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7;
 rv:12.0) Gecko/20120428 Thunderbird/12.0.1
MIME-Version: 1.0
Newsgroups: comp.lang.ada
Subject: Re: Q: type ... is new String
References: <jq5i58$qe8$1@speranza.aioe.org> <jqi6qb$oms$1@dont-email.me>
 <82defba0-2d39-4418-b678-ebbefeb105d7@x21g2000vbc.googlegroups.com>
In-Reply-To: 
 <82defba0-2d39-4418-b678-ebbefeb105d7@x21g2000vbc.googlegroups.com>
Message-ID: <4fcccd1f$0$6583$9b4e6d93@newsspool3.arcor-online.net>
Organization: Arcor
NNTP-Posting-Date: 04 Jun 2012 16:58:39 CEST
NNTP-Posting-Host: 9671df5b.newsspool3.arcor-online.net
X-Trace: 
 DXC=h3WmV?`X0hhUoRk[hk2WalMcF=Q^Z^V3h4Fo<]lROoRa8kF<OcfhCOk04[3RTi>fNfnc\616M64>jLh>_cHTX3jm^0Afk8Th_[i
X-Complaints-To: usenet-abuse@arcor.de
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Date: 2012-06-04T16:58:39+02:00
List-Id: <comp.lang.ada>

On 04.06.12 15:36, Maciej Sobczak wrote:

> I agree that most of the security problems that
> plague the web-development ecosystem could be solved with a proper
> type system and static type-safety.

To illustrate a problem, web programming is almost always confronting
I/O of untyped "text": of implicit, ambiguous, indeterminable,
inconsistent, wrong encoding. There is no perfect way to prevent
exception raising effects, remember that most systems are layered,
and disconnected. Basic AI is needed to make educated guesses about
to the meaning of octet sequences.

Any complaint about malformed output at the other end is likely
justified, but useless: "We *must* have the data. Do your best!"

The best one can do is classify I/O, then read input from sources
marked safe/unsafe, and finally use these data in typed structures.

Any countermeasure must be one of the masses: how can one make the
notion of type checking of web data so popular that it is considered
a must-have?