• SecureProgrammingLanguage

Requirements for a Secure Programming Language (R) :

1. No buffer overflows
2. Strongly typed language including integrated secure datatypes like Email addresses, IP addresses
3. Secure Database interface (not directly SQL!)
4. Easier to correctly verify parameters for complex datatypes (like email addresses, ...) than not to verify it correctly
5. Easier to develop secure code than to develop insecure code
6. Makes possibly insecure code VISIBLE by UPPERCASE
7. Useable for Web-Applications, Deamons, Standalone applications, ...
8. No insecure Exception-Handling (See C++ where anything can throw any exceptions, which undocumentedly break the interface specification)
9. Not using insecure linking (if possible not using linking at all)
10. Tainting mode (see Perl)
11. Secure ABI (see how "const" parameters are included in the C++ ABI, and how linkers care about it)
12. No self-modifying
13. No dynamic loading of code
14. Static linking possible

Optional features (O):

1. Object oriented (but CLEAN object orientedness, not C++ style)
2. Easy to learn, Easy to read
3. Both available as a compiled and as an interpreted language
4. Realtime capability

5. > 1 % market share in at least one area

Possible options:

ADA

• Market share?

E

• Market share?

Python

• Spaces change the semantics of the code, and can too easily break the code.

Smalltalk

• Market Share?

Perl

• Depends on the developer

Pascal

Less considered options:

Java

• does not respond to some of the criterias see R6 R13 R14 while GNU Java can be compiled
• has a wide programmer audience but has also it's butch of lazy programmers too, prone to unsecure programming
• will been released with an "open" license in Java JDK 6 (statement to be completed)

===