Re: Anybody in US using ADA ? New language competition? (long)

["Randy Brukardt" <randy@rrsoftware.com>]

Wes Groleau wrote in message ...
>If you make a new web server, it still has to interoperate with
>most of the things other webservers work with, or it won't get
>used.  And it isn't being used, is it?  Sure, by Ada fans, but
>that's not the point.


That's a lousy example. If you "interoperate" with those other things,
(i.e. plugins and CGIs), you're also bringing in the intractable
security problems of those other things.

That's precisely why I updated Tom Moran's web server to use for our
AdaIC backup server. It doesn't know how to execute another program (and
never will), so no one will ever be able to use it to launch Cmd.Exe, no
matter what garbage it is given. And most of the other security problems
you hear about can't happen, either. The only thing it writes is log
files, so an attacker can't use it to create files, either, no matter
what they do. About the worst that can happen is that they could use it
to cause a denial-of-service -- and given that it uses a set of Ada
tasks, even that would be fairly difficult.

Of course, it has to understand HTTP and make log files that analyzer
programs recognize, but the first is the definition of "web server" and
the latter is trivial.

But, all of that said, I think your basic point is correct.

               Randy Brukardt.