News for hackers. Stuff that matters.
Re:Java is not a safe language by oaiey on Monday June 13, 2022 @06:46AM (#31723571)
IMHO: click bait.

Half of the bullet point you find in 75% of all languages (eg int overflow, nullability, race conditions) or are ideas which are a security scientist dream of (eg named arguments).

There is barely something specific to Java and more esoteric.

Re:Java is not a safe language by formerly_proven on Monday June 13, 2022 @08:07AM (#31724290)
Overflows are a major source of security vulnerabilities. NULL values are a major source of logic bugs. Data races are the most common bugs in parallel and concurrent applications.

There is no real argument why programming languages as tools should stop at the level of "well you can't put a string into an int".

Re:Java is not a safe language by lumost on Monday June 13, 2022 @09:58AM (#31725658)
Is there really a way around this? overflow should be an error in most languages - but isn't for a variety of reasons such as simplifying the construct

c = a + b

In a language without native memory management, it's rare that this type of bug could lead to disclosure of sensitive information. In the cases it would, it's easy enough to guard the overflow with a test such as if (MAX_VAL - b) < a then error.

Chasing safety features which result in difficult to reason about semantics will inevitably lead to low language adoption. I'd be very interested in approaches which guard difficult cases while maintaining ease of use. I'd love a statically typed language which automatically increases the size of numeric type on over/underflow.

Re:Java is not a safe language by est31 on Monday June 13, 2022 @10:57AM (#31726499)
> overflow should be an error in most languages

> Chasing safety features which result in difficult to reason about semantics will inevitably lead to low language adoption.

Python solves this problem by not having overflow for integers at all, instead all integers are unlimited. It's still one of the most widely used languages in the world.

Re:Java is not a safe language by lumost on Monday June 13, 2022 @01:22PM (#31728564)
true, however python doesn't have static typing. It would be interesting to see more static languages adopt a "Number" primitive.
Re:Java is not a safe language by kaba0 on Monday June 13, 2022 @05:19PM (#31731898)
Haskell has it as well, in a very clever way in my opinion. Number literals don’t have a type themselves, they are inferred to be the correct type based on context/available type notations, etc.

There is both a 64bit integer type and an “infinite” one, and you can change the implementation by a single type notation, in a completely safe way.

Re:Java is not a safe language by throwaway4good on Monday June 13, 2022 @07:43AM (#31724050)
And they are mostly niche ideas that in practice gives overly verbose code filled with boilerplate making it just as insecure as languages that take a more pragmatic approach.
Re:Java is not a safe language by dtech on Monday June 13, 2022 @08:07AM (#31724292)
Named arguments are in a lot of modern languages: Python, Kotlin, Swift, Javascript*, probably others.

* APIs often do something similar by passing in an object with optional fields*

Re:Java is not a safe language by BeefWellington on Monday June 13, 2022 @10:36AM (#31726218)
> Javascript, > APIs often do something similar by passing in an object with optional fields*

That's really not the same as the others though, as it's a convention. That's arguing that passing a Python dict or Namespace to a function is the same as named arguments in the function's definition itself. You can do the same in Java with Dictionary<string,object> if you want.

Re:Java is not a safe language by dtech on Monday June 13, 2022 @04:07PM (#31731077)
I wouldn't call that the same. In Typescript the arguments object is fully typed, while in Java you lose all typing.
Re:Java is not a safe language by oaiey on Tuesday June 14, 2022 @01:33AM (#31735105)
They are but ultimately the author wish that their usage is enforced. And that is IMHO in no major language including the above.
Re:Java is not a safe language by kaba0 on Monday June 13, 2022 @05:20PM (#31731912)
(Nitpick, but is python a modern language? It is almost a decade older than Java)
Re:Java is not a safe language by dtech on Tuesday June 14, 2022 @02:22AM (#31735369)
Definition question. It fits if you use "languages that appeared after or incorporated features from younger languages in newer versions".

Also 4 years older, not a decade.