You are viewing a single comment's thread from:

RE: Could WREN be the future of Smart Contract Scripting Languages?

in #smartcontracts8 years ago

I took this quote from the official Lisk blog. Can you comment?

Lisk is written in JavaScript, which is not secure!

No! Even though JavaScript is a weakly typed language it doesn’t mean that it is inherently insecure. Yes, the programming language used plays an important role, but at the end of the day it is the developers obligation to write secure code in the first place. There are other programming languages we could have used, which owing to their strongly typed nature, make it less probable for the developer to write bad code. However, that doesn’t mean these languages do not come with other important trade offs. We chose JavaScript because it runs literally everywhere, is extremely popular & widespread, and has huge companies like Google or Microsoft working on its speed and security across a wide range of devices. Therefore, its ever increasing developer base and ease of access played a huge role in that decision.
With regard to JavaScript’s known limitation on number precision larger than 32 bits. We have worked around this limitation by conducting integer based arithmetic throughout the code base using BigNumber.js (a library for arbitrary-precision decimal and non-decimal arithmetic). Blockchain application developers are largely shielded by our API, or in cases which require it, they can utilize the same library used by the Lisk core. Therefore, this limitation is not a problem, nor has it been since Lisk’s inception.
To further strengthen the code base, we are planning an eventual transition to TypeScript — a strongly typed JavaScript super-set — which once implemented should mitigate the issues normally associated with weakly typed code. We are also contemplating pushing back certain critical core features to C++ for maximum speed and security. In summary, we are leveraging all options available to solve some of the known problems associated with using JavaScript on such a project as Lisk.

Sort:  

And their assumption is wrong. The compiler should be where the responsibility is to prevent insecure code from even being able to compile. Depending on thousands of individual developers means having to trust each and every developer and why would you want to do that? It increases your risk for zero gain. On the other hand if you use a secure language then you only have to trust the developers who write the compiler and design the secure language.

The fewer developers you have to trust the lower your risk.

Coin Marketplace

STEEM 0.30
TRX 0.12
JST 0.034
BTC 64136.70
ETH 3128.20
USDT 1.00
SBD 3.94