Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Virtual Machines and Memory Protections

Posted Nov 22, 2006 11:05 UTC (Wed) by jospoortvliet (subscriber, #33164)
Parent article: Virtual Machines and Memory Protections

so if you use any non-java library in java, or a non-mono library in mono,
you're screwed, right?
and linux is all about code-reuse, mostly in the form of libraries, right?

what about ruby, python, perl?

so security isn't a C# or java advantage, on the contrary. nor is
performance. what is, then?
it's fast to write apps in? is it seriously faster to write lets say a
music player a la amarok or a app like gaim/kopete in java/C# compared to
C/GTK2+/Gnome? and how does it compare to C++/Qt/KDE?

(Log in to post comments)

Virtual Machines and Memory Protections

Posted Nov 22, 2006 14:59 UTC (Wed) by NAR (subscriber, #1313) [Link]

so security isn't a C# or java advantage, on the contrary.

Not exactly. In case of C# or Java, these kind of memory-corruption bugs can be only in the virtual machine, in the JIT compiler and in the code generated by the JIT compiler, not in the actual code written by the developers. It's a lot less code to review and make it bugfree, compared to C where any code can overflow a buffer, not just the code in gcc.

Bye,NAR

Virtual Machines and Memory Protections

Posted Nov 22, 2006 15:43 UTC (Wed) by gouyou (subscriber, #30290) [Link]

Plus java has a feature where you can restrict the VM to only run signed code.

Virtual Machines and Memory Protections

Posted Nov 22, 2006 18:59 UTC (Wed) by bluefoxicy (guest, #25366) [Link]

> In case of C# or Java, these kind of memory-corruption bugs can be only in the virtual machine, in the JIT compiler and in the code generated by the JIT compiler, not in the actual code written by the developers.

Almost. If by "virtual machine" you also meant "and all the libraries it uses, such as Gecko or libpng," you're very close. Remember C# can also call non-C# code, as noted in the article.

Virtual Machines and Memory Protections

Posted Nov 22, 2006 19:24 UTC (Wed) by bluefoxicy (guest, #25366) [Link]

> so security isn't a C# or java advantage, on the contrary. nor is performance. what is, then?

The language itself is type-safe and memory safe, which is a huge advantage. See the big comment for an explanation of threats and mitigations for type-unsafe languages. A third solution is to use a new language that doesn't suffer those particular flaws, which is what C# and Java are.

It may be possible to run some C# programs exclusively using AOT compilation. Programs that don't use reflection (I suspect most) would be perfectly safe to pre-compile and load with the AOT mechanism. Things like IKVM or IronPython .. well, they need JIT or they become excessively slow.