Hacker News Reader

In contrast, I'd say a pure-C web page would be way easier to open to attacks than a PHP one.

String copy issues (termination), buffer/array overflows, machine-code (R)CE vulnerabilities,... an endless list of stuff which the PHP runtime actually protects a novice of.

View on HN

and a webpage written in assembly would be even more likely to be able to be attacked. Its a silly argument. No one is saying consider C for you next website.

Actually I am considering C. It's pretty easy to write a CGI that Apache can call. Process startup is pretty cheap on UNIX and it's secure if you suexec, chroot it and know how to write C code that isn't full of holes.

http://undeadly.org/ is written in C. Source: http://undeadly.org/undeadly-src.tar.gz

Wow! I didn't know that, I've always thought it was written in Perl.

Yes but it only takes one eval or config flag set wrongly for that to be moot.

It's perfectly possible to write a pure C web page that is 100% secure. It just requires experience.

The same with all other languages. PHP doesn't protect the novice, neither does C. Experience does.

> Yes but it only takes one eval or config flag set wrongly for that to be moot.

The same could be said about any language, however 'never use eval' is usually shouted quite loudly at anyone learning a scripting language.

Reply on news.ycombinator.com