Top 10 vulnerable languages for web app

Top 10 vulnerable languages for web app

[mockturtle]

Not strictly Ada-related, but I guess of some interest to this group...

According to the following article

   http://thehackernews.com/2015/12/programming-language-security.html

Veracode published a report (available at https://goo.gl/QVSF1t , registration required) about vulnerabilities in web applications. PHP is at third place, after ColdFusion and Classic ASP (never heard of them...)

One thing caught my attention in the article.  It says: 

  "...The security researchers crawled popular web scripting languages including 
PHP, Java, JavaScript, Ruby, .NET, C and C++, Microsoft Classic ASP, Android, 
iOS, and COBOL"
         ^^^^^

COBOL a scripting language?!?

Enjoy

Riccardo

Re: Top 10 vulnerable languages for web app

[David Botton]

> COBOL a scripting language?!?

Is ok, they list iOS and Android as languages too, at least COBOL could be used for "scripting".

David Botton

Re: Top 10 vulnerable languages for web app

[mockturtle]

On Friday, December 4, 2015 at 7:34:56 PM UTC+1, David Botton wrote:
> > COBOL a scripting language?!?
> 
> Is ok, they list iOS and Android as languages too, at least COBOL could be used for "scripting".
> 
> David Botton

Right, I did not notice iOS and Android...

Re: Top 10 vulnerable languages for web app

[mockturtle]

On Friday, December 4, 2015 at 7:34:56 PM UTC+1, David Botton wrote:
> > COBOL a scripting language?!?
> 
> Is ok, they list iOS and Android as languages too, at least COBOL could be used for "scripting".
> 
> David Botton

By the way, it would be amusing (for some value of "amusing") to code a web app in COBOL...

Re: Top 10 vulnerable languages for web app

[Paul Rubin]

mockturtle <framefritti@gmail.com> writes:
> By the way, it would be amusing (for some value of "amusing") to code
> a web app in COBOL...

Always my favorite:  http://coboloncogs.org

Re: Top 10 vulnerable languages for web app

[Daniel Otte]

On 05.12.2015 02:00, Paul Rubin wrote:
> mockturtle <framefritti@gmail.com> writes:
>> By the way, it would be amusing (for some value of "amusing") to code
>> a web app in COBOL...
> 
> Always my favorite:  http://coboloncogs.org
> 
I can add: http://azac.pl/cobol-on-wheelchair/

Re: Top 10 vulnerable languages for web app

[Per Sandberg]

They must be "security experts" ;)


Den 2015-12-04 kl. 19:10, skrev mockturtle:
> Not strictly Ada-related, but I guess of some interest to this group...
>
> According to the following article
>
>     http://thehackernews.com/2015/12/programming-language-security.html
>
> Veracode published a report (available at https://goo.gl/QVSF1t , registration required) about vulnerabilities in web applications. PHP is at third place, after ColdFusion and Classic ASP (never heard of them...)
>
> One thing caught my attention in the article.  It says:
>
>    "...The security researchers crawled popular web scripting languages including
> PHP, Java, JavaScript, Ruby, .NET, C and C++, Microsoft Classic ASP, Android,
> iOS, and COBOL"
>           ^^^^^
>
> COBOL a scripting language?!?
>
> Enjoy
>
> Riccardo
>

Re: Top 10 vulnerable languages for web app

[Norman Worth]

On 12/4/2015 11:10 AM, mockturtle wrote:
> Not strictly Ada-related, but I guess of some interest to this group...
>
> According to the following article
>
>     http://thehackernews.com/2015/12/programming-language-security.html
>
> Veracode published a report (available at https://goo.gl/QVSF1t , registration required) about vulnerabilities in web applications. PHP is at third place, after ColdFusion and Classic ASP (never heard of them...)
>
> One thing caught my attention in the article.  It says:
>
>    "...The security researchers crawled popular web scripting languages including
> PHP, Java, JavaScript, Ruby, .NET, C and C++, Microsoft Classic ASP, Android,
> iOS, and COBOL"
>           ^^^^^
>
> COBOL a scripting language?!?
>
> Enjoy
>
> Riccardo
>
The lesson seems to be that typical interpretive scripting languages are 
dangerous for the web.  Note that C and C++, while a bit vulnerable, are 
far safer than the scripting languages, and that interpreted languages 
are more susceptible to the more dangerous maladies like code insertion 
and command insertion.  Not surprising, really, when you consider how 
they work.