Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

plus.google.com

Post reply on HN
Print view View original

191–200 of 265 posts

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#191

Post by saraid216 »

babarock wrote: post #11
oneeyedpigeon wrote: post #4

I don't quite get Linus' problem with XML for document markup (for anything else - config files, build scripts - sure, XML is horrible). Does anyone know any more details about what his specific gripe is? For me, asciidoc (which looks very similar, conceptually, to markdown) suffers from one huge problem: it's incomplete. Substituting symbols for words results in a more limited vocabulary, if that vocabulary is to re…

For those who missed it, here's what Linus wrote in the comments: "+Aaron Traas no, XML isn't even good for document markup. Use 'asciidoc' for document markup. Really. It's actually readable by humans, and easier to parse and way more flexible than XML. XML is crap. Really. There are no excuses. XML is nasty to parse for humans, and it's a disaster to parse even for computers. There's just no reason for that horribl…

> in the end: putting everything in one file is just not a good idea. There's a reason people end up using simple databases for a lot of things.

I'd really like to hear more about this perspective, if anyone feels like they can elaborate.

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#192

Post by saraid216 »

Pxtl wrote: post #107
sp332 wrote: post #49

Earlier quoted context omitted.

I agree it's confusing, I think the submitter just meant "system for files" or something.

That would be excusable if we were talking abuot somebody who writes higher-level programs that would be excusable, but not for a kernel developer.

The submitter isn't Linus.

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#193

Post by Seeless »

davb wrote: post #180
seabee wrote: post #149

Earlier quoted context omitted.

In a world where users will willingly enter malicious code into their computers if they believe it will do something they want[1], can there really be a better way? [1] https://www.facebook.com/selfxss

Perhaps modern operating systems (or hardware?) need two modes - "Safe mode", where everything is sanitised, checked, limited and Secure Boot-style verified, and "Open mode" where it's not; where experts and enthusiasts can work without limit and without DRM.

That only adds an extra step to the social engineering process.

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#194

Post by [deleted] »

Seeless wrote: post #193
davb wrote: post #180

Earlier quoted context omitted.

Perhaps modern operating systems (or hardware?) need two modes - "Safe mode", where everything is sanitised, checked, limited and Secure Boot-style verified, and "Open mode" where it's not; where experts and enthusiasts can work without limit and without DRM.

That only adds an extra step to the social engineering process.

[deleted]

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#195

Post by malkia »

chalst wrote: post #154
JackC wrote: post #132

Earlier quoted context omitted.

You probably know this, but remember that storing user data as code is a place where you (general "you") have to think very carefully about security. Is there any way that arbitrary code in the file could compromise the user's system? If so, does the user know to treat these data files as executables? Is there any way someone untrusted could ever edit the file without the user's knowledge? Even in combination with ot…

I trust Lua sandboxing. See, e.g.: 1. http://stackoverflow.com/questions/1224708/how-can-i-create-... 2. http://stackoverflow.com/questions/4134114/capabilities-for-... I find it easier to trust Lua than similar facilities in other programming languages because the kernel of the language has a relatively simple semantics, so the TCB of a sandbox is lower, and the source is easier to understand than most other languag…

It's the halting problem - all it takes for someone to embed in your data code that loops forever (wait infinite), or recurses (crash), or discover some vulnerability... Not directly related to saving files as lua, but say as bytecode: https://www.youtube.com/watch?v=OSMOTDLrBCQ

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#196

Post by malkia »

unsigner wrote: post #152
JackC wrote: post #132

Earlier quoted context omitted.

You probably know this, but remember that storing user data as code is a place where you (general "you") have to think very carefully about security. Is there any way that arbitrary code in the file could compromise the user's system? If so, does the user know to treat these data files as executables? Is there any way someone untrusted could ever edit the file without the user's knowledge? Even in combination with ot…

Lua can be sandboxed so your data file can't call arbitrary functions (but can still call a controlled subset, e.g. a function called RGB that does r 255 255+g*255+b so your colors are somewhat human-readable in the file, yet 24-bit integers in memory). But it's still code, so you can e.g. inject an infinite loop and the loader will hang. (You can protect against this, you can install a debug hook that gets called af…

Or HashDOS attack - http://lua-users.org/wiki/HashDos

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#197

Post by haberman »

TelmoMenezes wrote: post #141
JackC wrote: post #132

Earlier quoted context omitted.

You probably know this, but remember that storing user data as code is a place where you (general "you") have to think very carefully about security. Is there any way that arbitrary code in the file could compromise the user's system? If so, does the user know to treat these data files as executables? Is there any way someone untrusted could ever edit the file without the user's knowledge? Even in combination with ot…

This is a good point, but I feel that discouraging this type of approach is not the way to go. I apologise in advance for ranting... I hope this is not too off-topic, but instead a "zoom out" on the issue. This touches on something deep and wrong about how we use computers these days. Computers are really good at being computers, and the amplification of intellectual capabilities they afford is tremendous, but this i…

Lack of Turing-completeness can be a feature. Take PDF vs PostScript. The latter is Turing-complete and therefore you cannot jump to an arbitrary page or even know how many pages the document has without running the entire thing first.

By limiting expressiveness you also gain static analysis and predictability. It's not about limiting the potential of computers, it's about designing systems that strike the right balance between the power given to the payload and the guarantees offered to the container/receiver.

For example, it is only because JSON is flat data and not executable that web pages can reasonably call JSON APIs from third parties. There really is no "better way" -- if JSON was executable then calling such an API would literally be giving it full control of your app and of the user's computer.

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#198

Post by eurleif »

haberman wrote: post #197
TelmoMenezes wrote: post #141

Earlier quoted context omitted.

This is a good point, but I feel that discouraging this type of approach is not the way to go. I apologise in advance for ranting... I hope this is not too off-topic, but instead a "zoom out" on the issue. This touches on something deep and wrong about how we use computers these days. Computers are really good at being computers, and the amplification of intellectual capabilities they afford is tremendous, but this i…

Lack of Turing-completeness can be a feature. Take PDF vs PostScript. The latter is Turing-complete and therefore you cannot jump to an arbitrary page or even know how many pages the document has without running the entire thing first. By limiting expressiveness you also gain static analysis and predictability. It's not about limiting the potential of computers, it's about designing systems that strike the right bala…

>There really is no "better way" -- if JSON was executable then calling such an API would literally be giving it full control of your app and of the user's computer.

Of course there's a "better way": running the code in a sandbox. You could do so using js.js[1], for example. (Of course, replacing a JSON API with sandboxed JS code is likely to be a bad idea. But it is possible.)

[1] https://sns.cs.princeton.edu/2012/04/javascript-in-javascrip...

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#199

Post by agumonkey »

mrcharles wrote: post #94

On the game I'm currently working on, it's built very heavily around Lua. So for the save system, we simply fill a large Lua table, and then write that to disk, as Lua code. The 'save' file then simply becomes a Lua file that can be read directly into Lua. This is absolutely amazing for debugging purposes. Also you never have to worry about corrupt save files or anything of it's ilk. Development is easier, diagnosing…

IIRC that's how Office and Photoshop file format started. I think it's a nightmare for compatibility in the end.

Re: Linus Torvalds: “I'm happily hacking on a new save format using ‘libgit2’”

#200

Post by wtallis »

saraid216 wrote: post #190
TelmoMenezes wrote: post #141

Earlier quoted context omitted.

This is a good point, but I feel that discouraging this type of approach is not the way to go. I apologise in advance for ranting... I hope this is not too off-topic, but instead a "zoom out" on the issue. This touches on something deep and wrong about how we use computers these days. Computers are really good at being computers, and the amplification of intellectual capabilities they afford is tremendous, but this i…

You're discouraging it in the wrong place. Learning to swim is not done by throwing a kid in the deep end of a pool. Learning to code is not done by encouraging bad security practices.

On the other hand, taking the easy way out when this kind of security problem comes up leads to having a machine that's just an appliance and not a computer. If you've closed every local code execution vulnerability, you've probably rendered your system completely non-programmable and erected a monumental barrier to learning how to hack.
Post reply on HN