211–220 of 265 posts
Earlier quoted context omitted.
>There really is no "better way" -- if JSON was executable then calling such an API would literally be giving it full control of your app and of the user's computer. Of course there's a "better way": running the code in a sandbox. You could do so using js.js[1], for example. (Of course, replacing a JSON API with sandboxed JS code is likely to be a bad idea. But it is possible.) [1] https://sns.cs.princeton.edu/2012/0…
You're right inasmuch as I shouldn't have implied that unsandboxed interpretation is the only option. But my larger point still stands; the fundamental tradeoff is still "power of the payload" vs "guarantees to the container." Even in the case of sandboxed execution, the container loses two important guarantees compared with non-executable data formats like JSON: 1. I can know a priori roughly how much CPU I will spe…
Earlier quoted context omitted.
In a world where users will willingly enter malicious code into their computers if they believe it will do something they want[1], can there really be a better way? [1] https://www.facebook.com/selfxss
Perhaps modern operating systems (or hardware?) need two modes - "Safe mode", where everything is sanitised, checked, limited and Secure Boot-style verified, and "Open mode" where it's not; where experts and enthusiasts can work without limit and without DRM.
On the game I'm currently working on, it's built very heavily around Lua. So for the save system, we simply fill a large Lua table, and then write that to disk, as Lua code. The 'save' file then simply becomes a Lua file that can be read directly into Lua. This is absolutely amazing for debugging purposes. Also you never have to worry about corrupt save files or anything of it's ilk. Development is easier, diagnosing…
If you ever used maven xml configs, java object marshalling or c# xml you would understand the pains of using xml as a file format for software projects and data representation. You have to find a solution that is language agnostic, neither LUA or JSON is.
Earlier quoted context omitted.
In a world where users will willingly enter malicious code into their computers if they believe it will do something they want[1], can there really be a better way? [1] https://www.facebook.com/selfxss
When it comes right down to it, you can't fully protect people from themselves. Even in 'meat space', which the general population is presumably experienced with, people talk others into doing things that they should not all the time. Anything from social engineering to bog-standard scam artists masquerading as door-to-door salesmen.
Also, if, for example, cars and airplanes and banks and nuclear submarines would accept executable code as input, some people would do damage on a gargantuan scale.
Clearly, being liberal in what you accept must end somewhere. I argue that it should end very, very soon. Even innocuous things such as "let's allow everybody to read the subject of everyone's mail messages", if available at scale and cheaply, would entice criminal behavior, for example by those mining them for information that you are away from home.
Does anybody know how RMS thinks about passwords nowadays?
Earlier quoted context omitted.
If excess CPU/non-halting behavior is the issue, you could run the code with a timeout.
You could. But that has downsides also: 1. imposing CPU limits incurs an inherent CPU overhead and code complexity. 2. if those limits are hit, you can't tell whether the code just ran too long or whether it was in an infinite loop. So now if we fully evaluate the options, the choice is between: 1. A purely data language like JSON: simple to implement, fast to parse, decoder can skip over parts it doesn't want, etc.…
Abstractions exist for a reason -- this is analogous to source/channel coding separation or internet layers. They don't have to be that way, but are there for a reason.
Someone could change my opinion, though. Provide me a data format which proves certain things about it's behavior and that would be a nice counterexample.
I'm not sure why git is the best tool for the job in this case, even after reading the post & some of the contents.
Earlier quoted context omitted.
And what about the people competing against the happy cheater?
in a single player game with save games on local disk? this question is nearly trolling.
Speedrunners are an exceptional case, but I think everyone gets a little annoyed when they look at a leaderboard and all the top players have scores of UINT_MAX or times of 0 seconds.
Obviously cheaters will find a way regardless of whether you give them the source code or not, I'm just saying dfc's concern is not totally ridiculous.
Earlier quoted context omitted.
Preach it. My favorite persistence code: stuff that has nothing to do with SQL/NoSQL. I leaned heavily on Python's pickle module for serializing a few thousand entities to disk a few years ago. By streaming them to the application at startup time, it remained plenty fast for all datasets it'd encounter. I intended to replace it with SQLite one day, but I never had to. I could just keep them all in memory. I'd probabl…
I used to do that, but pickle bit me once. I think it changes between versioning or something. I had to start the statistical model from scratch.
Earlier quoted context omitted.
When it comes right down to it, you can't fully protect people from themselves. Even in 'meat space', which the general population is presumably experienced with, people talk others into doing things that they should not all the time. Anything from social engineering to bog-standard scam artists masquerading as door-to-door salesmen.
But in 'meat space', it is way harder and more expensive to do evil against large numbers of people. For example, phishing as done electronically (throw a very, very wide net, and hope) doesn't make economical sense if one had to do it manually. Also, if, for example, cars and airplanes and banks and nuclear submarines would accept executable code as input, some people would do damage on a gargantuan scale. Clearly,…