I am a computer science student interested in the field of security and just had

Question

I am a computer science student interested in the field of security and just had a few questions.

What are the pros and cons for using C# for security purposes, I had assumed applications programmed in C# would be more prone to hacking etc. than C++ due to it being a higher level language and therefore being less "powerful" however I have read up online that C++ and C are not usually recommended for security reasons as buffer overflows cause a lot of security problems.

What are the "best" and "worst" programming languages to learn for security and why? Does it just come down to preference?

Apologies for the vague questions, I am still a beginner, please correct me if I have made any mistakes.

Thanks in advance!

Explanation / Answer

Lower level languages like C and C++ may be referred to as "unsafe" languages because it places a lot of responsibility on the programmer to get things right. For example, when you access and array element arr[i] the C compiler assumes that the programmer knows what he is doing and that i is a valid index for array arr.

Higher level languages such as C# and Java treat the programmer like an idiot and do runtime checks to make sure that arr points to a valid memory location, that i is a valid index for this array, etc. These runtime checks add overhead but in consumer applications where efficiency is not as paramount as keeping development cost low.

If you are interested in security then I would suggest that you study C and C++ since you will come face to face with issues like buffer overflows, heap corruptions, use after frees etc.

Higher level languages like Java are designed for people who don't know or care about security and does all it can to hide these problems from both the user and the programmer, which will not help you learn about these problems, it will just teach you to ignore them.

Many applications are written in high level languages but low level languages will always be relevant because someone needs to build the platforms that run the higher level stuff. Nearly all Java runtime environments are written in C++ and nearly all operating systems are written in C. Scripting languages such as Python Ruby and Perl are written in C. Ruby might be a safe language to program in but there could always be a bug in the underlying virtual machine.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.