Re: Embedded Keynote Speaker Mentions Ada

["Randy Brukardt" <randy@rrsoftware.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1944 bytes --]

"Bj�rn Persson" <spam-away@nowhere.nil> wrote in message
news:eIn4d.3914$d5.30556@newsb.telia.net...
Jeffrey Carter wrote:

>> www.AdaIC.com and archive.AdaIC.com run on a server with the web server
>> software written in Ada. According to Randy B, everything that goes
>> around on the internet has attacked the server, but nothing has
>> succeeded in over 3 years.

>Well, it's hardly surprising that a worm written for a certain
>vulnerability in Microsoft Internet Information Server can't hurt a
>totally different server.

True enough, but that's part of the point. Servers like IIS and Apache try
to be all things to all people by supporting various plugins and dynamic
configurations. These same features are often hijacked for malicious uses.
By doing the configuration at compile-time, and by avoiding support for
plugins and other dangerous options, the server is necessarily much more
secure. For instance, it isn't possible to cause the server to run a shell,
because there is no code in the server that can run any other program. Thus,
it is simply impossible to hijack it that way.

Of course, that's not specific to Ada. What has helped about Ada is that
errors can be trapped, logged, and then the task can continue to operate.
That's kept the server running even when it has had fairly significant bugs
(especially in handling malicious input). Those bugs could very well have
turned into a vulnerability in another programming language, but Ada's
checks caught the problems and raised exceptions before any real damage
could occur.

Of course, Ada is no silver bullet here. It's still necessary to pay close
attention to things like file traversal errors, and its certainly possible
that the server contains some sort of vulnerability. I would never say it
was impossible to crack, because that only encourages people to try (ask
Oracle about their vulnerability-free database...).

                          Randy.