Ryan Ware wrote: >Security. Here is an interesting read I found on The Inquirer >http://www.theinquirer.net/?article=13420 >VMS does much better than *nix. Also if memory serves VMS is the ONLY >operating system that has been tested at the Defcon that wasn't >compromised. I especially thought this quote in the article sheds >some light on why we have the security issues we do. "The other >significant feature of these operating systems is the language in >which they are written. The two from IBM are both written in assembler >and OpenVMS uses a range of about ten languages, one of which is C. > >C and similar languages that use pass-by-value techniques are >exceptionally prone to buffer overflow and the consequent potential >for unauthorized users to execute either their own malicious code or >other programs which run with enhanced access privileges. Avoiding the >use of these languages at the most vulnerable points, namely user I/O >and network I/O, would appear to be wise" > > Its been a long time since I've done development against VMS but as I recall one of the things we loved about the DEC compilers is that they used different stacks for variable length arguments as compared to fixed length data values, i.e. numbers/addresses on one stack and strings on another making it less of a problem. When we were starting the release testing process, the first box to get the new version was the VAX because it would kick out all sorts of faults that the other OS's and compilers would miss. Of course, at the time it was the only box out there that supported the concept of protected memory. I'd also be remiss if I didn't mention that the reason that you see C and assembler used for I/O is because that is a place where optimal code is needed the most. --rick _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota Help beta test TCLUG's potential new home: http://plone.mn-linux.org Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list