Another objection to my call for deprecating unsafe languages is that safety is not really necessary for services running behind a firewall. Those servers, the argument goes, can be optimized for speed over safety, so C/C++ is the right choice of language.

The problem with this argument is that firewalls are not really sufficient in today’s security environment. There are two reasons.

First, malware is rampant. It is very common for PCs to be infected. (Usually through memory corruption bugs, of course.) We know there are botnets composed of hundreds of thousands of PCs. Any of your employee machines behind the firewall can be compromised, giving a foothold to attackers.

Second, depending on your company, you may be the target of espionage. Large software development companies like Microsoft and Google have certainly been targeted. The Snowden documents have given plenty of evidence of this. You can’t assume that your own computers—or employees—won’t be probing your systems behind the firewall.

Using a firewall can be helpful, but I wouldn’t bet everything on just a firewall.