Re: Anyone looked at security features of D programming language?

[Crispin Cowan <crispin () immunix com>]

Greenarrow 1 wrote:

There is a comparison chart of different functions of D vs other languages 
at this site:


http://www.digitalmars.com/d/comparison.html


This "comparison" appears to be an advocacy piece by the D developers, 
and thus may be biased.


The comparison leaves out three conspicuous factors that I would want to 
see:


   * Comparison with CCured <http://manju.cs.berkeley.edu/ccured/> (a
     safer C variant)
   * Comparison with Cyclone
     <http://www.research.att.com/projects/cyclone/> (another safer C
     variant)
   * Whether or not D is statically type safe. Here's a hint:
         o D: no (inferred from the fact that it includes inline
           assembler and "Direct access to C")
         o C: no
         o C++: no
         o C#: yes (not sure how well validated that is)
         o Java: yes (though some dispute it)
         o CCured: I think so, but I'm not sure
         o Cyclone: claims to be, but I don't know how well validated
           that is

Static type safety is the gold standard of "secure" programming 
languages. Any language that asks you to pay the price of porting to a 
new language and yet does not offer static type safety is IMHO worthless 
junk. So based on D's own marketing claims, I don't think it is even 
worth a second look. Instead, consider Java, C#, Cyclone, and CCured.


Disclaimer: I have no interest in any of these products. My product is a 
safer C compiler (StackGuard) that also does not offer type safety, but 
also does not ask you to do any porting: it just compiles standard C/C++ 
programs and adds some safety checks, i.e. just a compiler enhancement, 
not a new language.


Crispin

--
Crispin Cowan, Ph.D.  http://immunix.com/~crispin/
CTO, Immunix          http://immunix.com
Immunix 7.3           http://www.immunix.com/shop/