Re: [Boston.pm] Historical question: origin of the idea of tainting

On 4/17/19 9:29 AM, Andy Oram wrote:
> For a report I'm writing, I'm trying to trace back the idea of tainted data
> for security purposes. I know it was in Perl in the 1990s. Does anyone on
> this list know where it started, where the term came from (it certainly
> seems like a typical Wall coining), and when it entered Perl?
>
>

hi andy,

it is in the perl4 book so it goes back a long while. it mentions setuid 
programs which goes even further back in unix time. so the concept of 
controlling how user data can get into secure programs is not new at 
all. as you say, i suspect the name taint was larry's invention but you 
can ask him. using a taint flag to track tainted data from the outside 
also feels like a perlish invention as that can only be done with a 
dynamic language and perl was the first real one. (shell doesn't count 
and always had leaks). another reason for tainting was perl was the main 
language of early web pages where outside data was always around.

uri