Search Mailing List Archives


Limit search to: Subject & Body Subject Author
Sort by: Reverse Sort
Limit to: All This Week Last Week This Month Last Month
Select Date Range     through    

[liberationtech] Programming language for anonymity network

Stevens Le Blond stevens at mpi-sws.org
Fri Apr 18 01:26:37 PDT 2014


Hello,

We are a team of researchers working on the design and implementation of
a traffic-analysis resistant anonymity network and we would like to
request your opinion regarding the choice of a programming language /
environment. Here are the criteria:

1) Familiarity: The language should be familiar or easy to learn for
most potential contributors, as we hope to build a diverse community
that builds on and contributes to the code.

2) Maturity: The language implementation, tool chain and libraries
should be mature enough to support a production system.

3) Language security: The language should minimize the risk of security
relevant bugs like buffer overflows.

4) Security of runtime / tool chain: It should be hard to
inconspicuously backdoor the tool chain and, if applicable, runtime
environments.

To give two concrete examples:

Using the C language + deterministic builds is an attractive option with
respect to 1), 2) and 4), but doesn’t provide much regarding 3).

Java does better with respect to 3), however, it trades some of 3) and
4) as compared to C. Specifically, we are concerned that large runtimes
may be difficult to audit. A similar argument may apply to other
interpreted languages.

Given these criteria, what language would you choose and for what
reasons? We would also appreciate feedback regarding our criteria.

All the best,
David, Nick, Peter, Stevens, and William




More information about the liberationtech mailing list