Re: [Boston.pm] Historical question: origin of the idea of tainting

Thanks, Uri. I don't want to bother Larry over this tiny historical detail.
Now that you tell me that tainting was in Perl 4, that pushes the origin to
the early 1990s or before. That's one detail I can use.

Andy Oram  |  Editor
O'Reilly Media, Inc.  |  617-499-7479 |  oreilly.com

[image: oreilly_email_logo.png] <http://oreilly.com/>




On Wed, Apr 17, 2019 at 9:52 AM Uri Guttman <uri-X/[email protected]> wrote:

> On 4/17/19 9:29 AM, Andy Oram wrote:
> > For a report I'm writing, I'm trying to trace back the idea of tainted
> data
> > for security purposes. I know it was in Perl in the 1990s. Does anyone on
> > this list know where it started, where the term came from (it certainly
> > seems like a typical Wall coining), and when it entered Perl?
> >
> >
>
> hi andy,
>
> it is in the perl4 book so it goes back a long while. it mentions setuid
> programs which goes even further back in unix time. so the concept of
> controlling how user data can get into secure programs is not new at
> all. as you say, i suspect the name taint was larry's invention but you
> can ask him. using a taint flag to track tainted data from the outside
> also feels like a perlish invention as that can only be done with a
> dynamic language and perl was the first real one. (shell doesn't count
> and always had leaks). another reason for tainting was perl was the main
> language of early web pages where outside data was always around.
>
> uri
>
> _______________________________________________
> Boston-pm mailing list
> [email protected]
> https://mail.pm.org/mailman/listinfo/boston-pm
>