Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Actually I do, to the point I have been appointed a couple of security positions in the past in the defence industry.

Code is executable.

Data is not. There should be no level of turing completeness.

Taking C as an example, loading a char* with data that contains code and jumping to it or letting it overwrite the code segment is precisely where it breaks down. The same is true when your json payload contains a function or your css contains an expression.

The main problem at the moment is that technologies freely interchange the two concepts. Code should be entirely immutable once compiled and data should not be executable.



But the pragmatic approach is to assume that data may become executable due to vulnerabilities and design around that fact. Assuming that you can control everything is fanciful and dangerous. Assuming that you control nothing, and everything can and will break is a much safer approach.


The pragmatic approach is to use a toolchain which prevents data being executable. Most high level languages without pointers and direct memory access (excluding dynamic languages) perform this feat quite well.

I disclaim the use of hacks like non executable segments here in certain CPU architectures (x86 LDT/GDT controlled access bits) as they are an afterthought.


So you just have to force every piece of code on your computer to use that tool chain. "Dear Mr Zuckerberg, please make Facebook available in a form that allows me access without needing to rely on dynamic languages and uses a strictly defined toolchain (of my choosing)". Good luck with that.


How do you implement an interactive page under that model?


Maybe we should think about moving away from interactive pages. What does all that interaction get us, really?


Agree. To be honest I'm not sure we should have gone past that point originally.


Can't tell if being facetious or just totally disconnected from reality.


an idealist. There's nothing wrong with wanting to improve the status quo.


You're not really talking about improving the status quo. You're talking about a temporal paradox in which you rewrite history.


>Actually I do, to the point I have been appointed a couple of security positions in the past in the defence industry.

>Code is executable.

>Data is not. There should be no level of turing completeness.

I'm sorry for the defence industry.


Why? They make shit that works with huge investment when the rest of the world makes do with shit that doesn't work properly for very little investment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: