From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me
X-Spam-Level: 
X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,
	REPLYTO_WITHOUT_TO_CC autolearn=no autolearn_force=no version=3.4.4
X-Google-Thread: 103376,bb14f1c1986544fb
X-Google-NewGroupId: yes
X-Google-Attributes: gida07f3367d7,domainid0,public,usenet
X-Google-Language: ENGLISH,UTF8
Path: 
 g2news1.google.com!news4.google.com!feeder.news-service.com!94.75.214.39.MISMATCH!aioe.org!.POSTED!not-for-mail
From: "Nasser M. Abbasi" <nma@12000.org>
Newsgroups: comp.lang.ada
Subject: Re: Does Ada need a 'secure coding standard' as well?
Date: Sat, 28 May 2011 12:38:56 -0700
Organization: Aioe.org NNTP Server
Message-ID: <irrj0h$6cb$1@speranza.aioe.org>
References: <irrgb6$vib$1@speranza.aioe.org> <op.vv7go1jvule2fv@douda-yannick>
Reply-To: nma@12000.org
NNTP-Posting-Host: TUXTYYqX1yG7hs3zxUg7ng.user.speranza.aioe.org
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Complaints-To: abuse@aioe.org
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
 rv:1.9.2.17) Gecko/20110414 Thunderbird/3.1.10
X-Notice: Filtered by postfilter v. 0.8.2
Xref: g2news1.google.com comp.lang.ada:19543
Date: 2011-05-28T12:38:56-07:00
List-Id: <comp.lang.ada>

On 5/28/2011 12:06 PM, Yannick Duchêne (Hibou57) wrote:

>
> Except that, there already exist to some Ada subset, or profiles. One of
> the most common is the one which is required with SPARK. Here again, no
> need to setup some rules and ask the authors to follow these rules and
> nothing else, as these are already checked by the SPARK Checker.
>

That was my initial reaction to when I saw those rules,
is that a well designed secure language, would not need such rules
(or much of then any them) for a programmer to remember, since
the compiler will check and reject code written which is 'not secure'
as it will be something not allowed at the language level itself.

But when I said that in the Java newsgroup I got screamed at :)

Most of the rules seem to target handling strings, where,
as one would expect, most of the security problems can sneak in.

The funny thing, is that Java 7 just added a switch on string  !

http://www.vineetmanohar.com/2011/03/new-java-7-feature-string-in-switch-support/

So, may be now more rules needs to be added for the programmer
to remember when using this new feature added by the language,
so they can use it in 'secure' way.

--Nasser