C# verses Pascal on Security lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- kamaunyrroh · 2016-10-08 14:27 Which programming platform is more secure! The recent hacks in the United States and South Korea indicate that security is a serious issue! I think all the protocols have to be followed, but which one is more secure, I know Pascal or Delphi is very light! It is more elegant than Meanstack I guess although I haven't tested it that much, but compared to ASP. What is your recommendation, I know Pascal has had a development gap of around 10years! But what's your take on Security: Pascal vs C language? ---------------------------------------------------------------------- marcov · 2016-10-08 14:57 Well, I see .NET security fixes nearly every month, but don't see Delphi ones that often. That might be partially obscurity, but the trouble with .NET is that nearly the whole VM is exposed for attach in every program. Anyway, I think this kind of discussion is better geared at a more general forum that is about multiple languages. This forum is about a specific implementation of Pascal. ---------------------------------------------------------------------- kamaunyrroh · 2016-10-08 15:12 Do you know where I can begin developing web APIs in Lazarus? I could not find a website with getting started with Web services in Pascal. This page does not introduce it for beginners to start developing WebAPis http://wiki.freepascal.org/Web_Service_Toolkit ---------------------------------------------------------------------- RAW · 2016-10-08 15:15 I think real security has nothing to do with a special platform or with a special programming language. Most programmers don't have the time to program their software in a way that makes it harder to crack it. I guess even more don't know how to do that... The hardware of a standard personal computer is not secure... how can software change that problem? Our Internet was never intended to be secure and on top of this fact people want to establish anonymity and security. Very funny... Maybe RUST is more secure than other languages, at least the programmers of RUST are telling that. ---------------------------------------------------------------------- tr_escape · 2016-10-08 15:23 Maybe you can examine c# .exe files your self with ILSPY decompiler. http://ilspy.net/ But security isn't about your development base / software it all about your methods/functions and your care. My advise read first: https://en.wikipedia.org/wiki/Buffer_overflow Also each software has to use system memory and you can create a virtual system to read memory of your software this means all software can hackable. But if your system is closed to anyone it will be more secure but useless Have fun ---------------------------------------------------------------------- tr_escape · 2016-10-08 15:33 Quote from: SoE on October 08, 2016, 05:15:45 pmMaybe RUST is more secure than other languages, at least the programmers of RUST are telling that. I tried to some unwanted condition on this example of the RUST language it finished with by time out (!) good... http://rustbyexample.com/flow_control/while.html I changed local condition long number: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i fn main() {    // A counter variable    let mut n = 1;     // Loop while `n` is less than 101    while n < 1010000000 {        if n % 15 == 0 {          println!("fizzbuzz");        } else if n % 3 == 0 {            println!("fizz");        } else if n % 5 == 0 {            println!("buzz");        } else {            println!("{}", n);      }         // Increment counter        n += 1;    }}  Because some of system can working on web site but if you write endless loop they can't be give any response... ---------------------------------------------------------------------- Thaddy · 2016-10-08 16:09 Quote from: kamaunyrroh on October 08, 2016, 04:27:08 pmWhich programming platform is more secure! The recent hacks in the United States and South Korea indicate that security is a serious issue! I think all the protocols have to be followed, but which one is more secure, I know Pascal or Delphi is very light! It is more elegant than Meanstack I guess although I haven't tested it that much, but compared to ASP. What is your recommendation, I know Pascal has had a development gap of around 10years! But what's your take on Security: Pascal vs C language? Security isn't really about the language. Security is about best practice. Because security is hard to do right there are hacks. There is, however one specific language feature in Object Pascal that would make it a better candidate to implement security and that is its string type. In C it is very easy to write beyond the length of a string, causing many of the buffer overflows (apart from user studipity unexpected behavior the second most important cause of hacks). In Object Pascal the string length is determined, making it hard to write beyond a string's length. Still possible, but harder w/o typecasts, absolute arrays declared over a string etc. The problem is that there are not many people that do security related libraries in pure pascal. I am one of very, very few that are also sufficiently educated in the field. So in practice I do not use my own code, but I use open source code that has a high user base and preferably a number of trusted developers. That is because that code can be reviewed by many and has a much higher chance that irregularities or flaws are discovered (magnitudes higher than my won software). And that code is mostly written in C (plain C or C++). So here are some pointers: - rely on standard security and crypto libraries, they are safer by definition than others even if their hacks are higher profile. - link them to your pascal code, all the important ones have Pascal bindings. - review your own sourcecode and let others review your sourcecode - good, safely written sourcecode is also very clearly written sourcecode.Not spaghetti code. - do not obfuscate anything, it has no purpose, really, none whatsover - that also means never ever rely on security by obscurity as your first line of defence, not even your second - Always test your sourcecode with: - test hashes for constant time. That means full boolean evaluation must be ON.! I know a lot of Object Pascal libs that screwed that up, including Delphi and FPC standard libraries (corrected when I found them, btw) - ALWAYS compile your sourcecode during debugging with proper debug options: rangechecks, IO checks, overflow checks, stack checks and assertions. Leave most out in production. - Don't use pointers, don't use PChar's/ That also means that if you can use a var or out parameter and the library declares it as a pointer type, re-declare it yourself. - Address all warnings,compile with -Sew, not ignore them, but fix them. - And keep those third party libraries current. - Never store passwords. Store hashes of passwords. - All user input must be validated at RUNTIME, never assume anything about user input. - All connections must be secure, even local database connections. Use certificates. Use certificates all over your infrastructure. Different ones for different tasks/access. - Use segmentation. - Always be prepared you wil get hacked, not if but when - Log, Log, Log and do something with the logs every day. - critical routines should be examined on assembler output. Never trust the compiler - sign your binaries. No really, even self-sign them. it is GOOD. - On database level use parameterized queries and if possible triggers and stored procedures. Never expose a query language to the user directly. (Did you really call your son "drop table"?) Most of the above can also be done in C(++) but Object Pascal has the benefit of its string type. ---------------------------------------------------------------------- Thaddy · 2016-10-08 17:27 Quote know Pascal has had a development gap of around 10years! Who told you that? Not true. ---------------------------------------------------------------------- Thaddy · 2016-10-08 17:36 A good example is right here on the forum: a new hash library that when used makes you vulnerable for timing and butterfly attacks. That is because that code was not reviewed on timing attacks. Remember: test hashes for constant time. That means full boolean evaluation must be ON for every secure hashing algorithm.. That has nothing to do with the language, but is programmer error. ---------------------------------------------------------------------- kamaunyrroh · 2016-10-09 08:20 Thaddy &  SoE, Thank you very much, I love Pascal or what we now call delphi! I think I will do some research on Rust, and see what comes up! However, is there a way to convert VB.NET code into pascal? I really need help on that one so that, I can avoid all these hack issues! ---------------------------------------------------------------------- Thaddy · 2016-10-09 08:29 Quote from: kamaunyrroh on October 09, 2016, 10:20:58 amThaddy &  SoE, Thank you very much, I love Pascal or what we now call delphi! I think I will do some research on Rust, and see what comes up! However, is there a way to convert VB.NET code into pascal? I really need help on that one so that, I can avoid all these hack issues! You can't. (2 times) - you can not automatically convert the VB code because it depends on .net libraries - you can not avoid hack issues. Part of what I tried to explain is, regardless of the language you use, the question is not if you can be hacked, but when... The .net libraries in itself are an extra attack surface, btw, because the underlying security related low-levelcode is written in MS C(++) anyway and is native code, not .net. .Net only provides convenient wrappers and high-level access. ---------------------------------------------------------------------- Leledumbo · 2016-10-09 09:39 Quote from: kamaunyrroh on October 08, 2016, 04:27:08 pmI know Pascal has had a development gap of around 10years! Not a single year since its publication in 1970 Pascal has ever stopped being developed. It's just most people who are unaware of its continuous development. Quote from: kamaunyrroh on October 08, 2016, 05:12:50 pmDo you know where I can begin developing web APIs in Lazarus? I could not find a website with getting started with Web services in Pascal. This page does not introduce it for beginners to start developing WebAPis http://wiki.freepascal.org/Web_Service_Toolkit Because beginners don't play with web API. Once you understood how HTTP protocol works, you already have 90% of web API in hand. Everything else (data format, protocols, authentication & authorization mechanism, error handling) is just conventions built on top of it. Bottomline: You don't need web service toolkit to build or consume any web service APIs, it's just a tool that eases everything, but is useless if you have inadequate knowledge of the underlying concepts. Quote from: kamaunyrroh on October 09, 2016, 10:20:58 amI love Pascal or what we now call delphi! It was, is and will always be Pascal. Delphi is just a Pascal implementation regardless what embarcadero says Quote from: kamaunyrroh on October 09, 2016, 10:20:58 amHowever, is there a way to convert VB.NET code into pascal? I really need help on that one so that, I can avoid all these hack issues! To further adds Thaddy, converting something coded in one language to another is not just a matter of syntax, but even the syntax alone could already be a problem if a concept from source language doesn't exist or cannot be implemented (or at least emulated) in the destination language. Reflection in .NET languages vs RTTI in Pascal for example. The two concepts, while being similar from higher level view, differ a lot in the implementation. Hence, porting code depending on such functionality is near impossible without rewriting. ---------------------------------------------------------------------- RAW · 2016-10-10 11:35 @Thaddy, thank you very much, very interesting... Quote- Use segmentation. Can you explain this a little bit? I don't understand what you mean? ---------------------------------------------------------------------- Thaddy · 2016-10-10 11:43 Quote from: SoE on October 10, 2016, 01:35:55 pm@Thaddy, thank you very much, very interesting... Quote- Use segmentation. Can you explain this a little bit? I don't understand what you mean? Your infra structure needs to be segmented. Simple example: database run in a cluster on a separate zone in the internal network. Databases that need only limited interaction with eachother are in different zones. The databases are never exposed to the internet. They are separated. With firewalls. The internet-facing parts are also separated. - ad-serving code is on a separate server. - db Interfracing code runs on a separaret server. - content itself runs on a separate server. All this is connected internally so that the outwards facing interface is transparent to a user, but internally the architecture is such that it is easy to detect single point of failures. On all these layers are security measures that limit access to just enough to work. ---------------------------------------------------------------------- Phil · 2016-10-12 18:52 Quote from: Thaddy on October 08, 2016, 06:09:33 pmSo here are some pointers: Thaddy, this is quite a fascinating list. It would great to see it expanded into an article (or even wiki entry) with additional discussion on many of the points, with code examples where appropriate. For example, just on the topic of signing code, that's something that would be useful to get an overview on for many here. (To my knowledge, the Lazarus installers have never been signed.) And which of these apply primarily to Web apps/server apps and which to desktop apps (or to both). -Phil