RE: Is Lua used as a data representation language?

[Thijs Schreijer <thijs@...>]

> Behalf Of Robert Virding
> Sent: dinsdag 8 januari 2013 18:06
> To: Lua mailing list
> Subject: Re: Is Lua used as a data representation language?
> 
> I don't think being defensive is good enough here. If you are accepting
> "data" into your system from the outside world you really have to be
> paranoid and assume they are out to get you. Because they will be! It is
> not much different building firewalls where the safest way is to start by
> blocking everything and then only allow the bare minimum. Depressing
> perhaps, but the only safe way to go.
> 
> Robert
> 

I meant defensive not as much as the data strategy, but more to the way your stance in this will maintain the status-quo that nothing can be done.
To me it is exactly the firewall example. If one is so strict about security, you wouldn't need a firewall, because you never would have plugged it in the network anyway.
Only after experimenting firewalls became strong enough as to trust them. So to me the sandboxed data execution is the equivalent of the firewall and once good enough, you can plug it in the network and trust it.
(and yes, some failures and incidents will be seen along the way)

Thijs


> ----- Original Message -----
> > From: "Thijs Schreijer" <thijs@thijsschreijer.nl>
> > To: lua-l@lists.lua.org
> > Sent: Tuesday, 8 January, 2013 11:19:56 AM
> > Subject: Re: Is Lua used as a data representation language?
> >
> >
> > > I think that having a data representation language which is
> > > executable is extremely dangerous and I would never use it unless
> > > the "data" came from an extremely trusted source. Basically myself.
> > > Even if I had written my own interpreter for it. This is one case
> > > where data should definitely be data and nothing else.
> > >
> > > Robert
> >
> > In general I would agree to that, but it is also a very defensive
> > point of view. I would like to see where this is going and whether it
> > can be sandboxed well enough to be safe enough (whatever that might
> > be).
> > If you don't try, you won't know.
> >
> > Thijs