Post B4cWLVVnZgLlxSZVzs by porglezomp@mastodon.social
 (DIR) More posts by porglezomp@mastodon.social
 (DIR) Post #B4bORWhJ5NYga6M0YK by thephd@pony.social
       0 likes, 0 repeats
       
       @seanmiddleditch I've noticed that a lot of people sort of forgot the power in "I just have a data file I can carry around that can be safely loaded because its restriction is the point" and just keep doing things like "What if I gave someone access to an unrestricted python / Lua / JavaScript / {etc.} interpreter as part of my program?".
       
 (DIR) Post #B4bOX4Xyf4Uj0mdPlo by thephd@pony.social
       0 likes, 0 repeats
       
       @seanmiddleditch The worst part is they don't even try to lock things down. Like, oh, yeah, sure, here's my Lua interpreter with direct access to the whole file system. And I can access the FFI so I can touch every single system call if I really try. Awesome. Thanks. This won't come back to fuck us all over!
       
 (DIR) Post #B4bXz1N6xYrIrLxD3w by thephd@pony.social
       0 likes, 0 repeats
       
       @seanmiddleditch truly, there is no security posture more foolproof!
       
 (DIR) Post #B4bn7qJovGo6Uv4yae by PeterSommerlad@mastodon.social
       0 likes, 0 repeats
       
       @thephd @seanmiddleditch In my experience: most configuration data formats end up being turing complete without a debugger or type checking
       
 (DIR) Post #B4bpb12ULKtW3L0jaa by horenmar@mastodon.social
       0 likes, 0 repeats
       
       @thephd @seanmiddleditch This is one of the things I point to vcpkg doing much better than Conan.Do I want to perform dependency resolution throughA) Downloading and running Python scriptsB) Parsing few json filesEven if you don't care about the security implications, just the performance difference is massive.
       
 (DIR) Post #B4cWLVVnZgLlxSZVzs by porglezomp@mastodon.social
       0 likes, 1 repeats
       
       @seanmiddleditch LLDB does have declarative summaries https://lldb.llvm.org/use/variable.html (which can be embedded in the binary at least in Apple LLDB, I can’t tell if that got upstreamed) and I don’t remember the current status but Adrian was working on expanding this for more complex functionality: https://discourse.llvm.org/t/a-bytecode-for-lldb-data-formatters/82696