Re: Specification for Trusted PLs?
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: David Fetter <david@fetter.org>
Cc: Stephen Frost <sfrost@snowman.net>, Magnus Hagander <magnus@hagander.net>, Josh Berkus <josh@agliodbs.com>, pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2010-05-21T18:11:12Z
Lists: pgsql-hackers
David Fetter <david@fetter.org> writes: > On Fri, May 21, 2010 at 12:26:24PM -0400, Stephen Frost wrote: >> I'm really not sure that we want to be in the business of writing a >> ton of regression tests to see if languages which claim to be >> trusted really are.. > That is *precisely* the business we need to be in, at least for the > languages we ship, and it would behoove us to test languages we don't > ship so we can warn people when they don't pass. I can't see us writing an AI-complete set of tests for each language we ship, let alone ones we don't. Testing can prove the presence of bugs, not their absence --- and that applies in spades to security holes. regards, tom lane