4 ms·

The concept of programming by string substitution really needs to die, and operating systems need to stop enabling it with functions like system(). Any time yo

by panic 11y ago

The concept of programming by string substitution really needs to die, and operating systems need to stop enabling it with functions like system(). Any time you have to think about "sanitizing" strings, terrible mistakes are going to happen.

TeMPOraL 11y ago
That's what we've got from switching from Lisp machines to x86 and C. It's funny how the 'stitching strings together' problem was solved 50 years ago and the modern web still didn't get the memo.
- LunaSea 11y ago
  I don't think anyone got the memo in any industry. Also if Lisp would be more popular in the industry I'm sure that we would find similar vulnerabilities as well.
  - TeMPOraL 11y ago
    No doubt about vulnerabilities. But I'm not talking about vulnerabilities, but about a particular kind of stupid behaviour that creates an immense class of vulnerabilities. Stitching, parsing and reparsing strings is not the right way to handle structured data. We knew that for almost half the century, we had tools for doing it properly since about the same time, and yet most popular frameworks, tools and even Unix itself are stuck deep in that mistake.
    - nolok 11y ago
      On that note, using powershell for a while really made me wish Unix would move to something beyond mere pipes. I love the Unix command line, but sharing structured data seamlessly is simply better
      - TeMPOraL 11y ago
        Yeah, PowerShell is great. It's a bit cumbersome to use for me[0], but passing objects instead of plaintext is a step (back) in the right direction. [0] - Maybe I'm missing some sane config sets? I'm not a very experienced PS user.
      - CaptSpify 11y ago
        What makes powershell's system better? I've never used it
        TeMPOraL 11y ago
        You pass around .NET objects instead of plaintext. Which means information you work on retains its metadata even after lots of piping, and you don't have to invent ad-hoc sed/awk-based microparsers that will break on another machine anyway (be it because of different locale or different command implementation). You operate on objects, and in the end - if you're printing to e.g. terminal - you decide how to display the data. A simple example - equivalent of ls -la with sorting by size: Get-ChildItem | Sort-Object length. You can sort like that because each entry returned by Get-ChildItem is in fact an object. In case of files, it's an object of type System.IO.FileInfo. Some of available properties are: Attributes Property System.IO.FileAttributes Attributes {get;set;} CreationTime Property datetime CreationTime {get;set;} CreationTimeUtc Property datetime CreationTimeUtc {get;set;} Directory Property System.IO.DirectoryInfo Directory {get;} DirectoryName Property string DirectoryName {get;} Exists Property bool Exists {get;} Extension Property string Extension {get;} FullName Property string FullName {get;} IsReadOnly Property bool IsReadOnly {get;set;} LastAccessTime Property datetime LastAccessTime {get;set;} LastAccessTimeUtc Property datetime LastAccessTimeUtc {get;set;} LastWriteTime Property datetime LastWriteTime {get;set;} LastWriteTimeUtc Property datetime LastWriteTimeUtc {get;set;} Length Property long Length {get;} Name Property string Name {get;} BaseName ScriptProperty System.Object BaseName {get=if ($this.Extension.Length -gt 0){$this.Name.Re... VersionInfo ScriptProperty System.Object VersionInfo {get=[System.Diagnostics.FileVersionInfo]::GetVer... You can sort by any of these. And each object has even more methods available, like Delete(), Encrypt() or SetAccessControl(). Examples of formatting: https://technet.microsoft.com/en-us/library/dd347677.aspx https://technet.microsoft.com/en-us/library/dd347677.aspx.

by panic 11y ago

TeMPOraL 11y ago

That's what we've got from switching from Lisp machines to x86 and C. It's funny how the 'stitching strings together' problem was solved 50 years ago and the modern web still didn't get the memo.

LunaSea 11y ago
I don't think anyone got the memo in any industry. Also if Lisp would be more popular in the industry I'm sure that we would find similar vulnerabilities as well.
- TeMPOraL 11y ago
  No doubt about vulnerabilities. But I'm not talking about vulnerabilities, but about a particular kind of stupid behaviour that creates an immense class of vulnerabilities. Stitching, parsing and reparsing strings is not the right way to handle structured data. We knew that for almost half the century, we had tools for doing it properly since about the same time, and yet most popular frameworks, tools and even Unix itself are stuck deep in that mistake.
  - nolok 11y ago
    On that note, using powershell for a while really made me wish Unix would move to something beyond mere pipes. I love the Unix command line, but sharing structured data seamlessly is simply better
    - TeMPOraL 11y ago
      Yeah, PowerShell is great. It's a bit cumbersome to use for me[0], but passing objects instead of plaintext is a step (back) in the right direction. [0] - Maybe I'm missing some sane config sets? I'm not a very experienced PS user.
    - CaptSpify 11y ago
      What makes powershell's system better? I've never used it
      - TeMPOraL 11y ago
        You pass around .NET objects instead of plaintext. Which means information you work on retains its metadata even after lots of piping, and you don't have to invent ad-hoc sed/awk-based microparsers that will break on another machine anyway (be it because of different locale or different command implementation). You operate on objects, and in the end - if you're printing to e.g. terminal - you decide how to display the data. A simple example - equivalent of ls -la with sorting by size: Get-ChildItem | Sort-Object length. You can sort like that because each entry returned by Get-ChildItem is in fact an object. In case of files, it's an object of type System.IO.FileInfo. Some of available properties are: Attributes Property System.IO.FileAttributes Attributes {get;set;} CreationTime Property datetime CreationTime {get;set;} CreationTimeUtc Property datetime CreationTimeUtc {get;set;} Directory Property System.IO.DirectoryInfo Directory {get;} DirectoryName Property string DirectoryName {get;} Exists Property bool Exists {get;} Extension Property string Extension {get;} FullName Property string FullName {get;} IsReadOnly Property bool IsReadOnly {get;set;} LastAccessTime Property datetime LastAccessTime {get;set;} LastAccessTimeUtc Property datetime LastAccessTimeUtc {get;set;} LastWriteTime Property datetime LastWriteTime {get;set;} LastWriteTimeUtc Property datetime LastWriteTimeUtc {get;set;} Length Property long Length {get;} Name Property string Name {get;} BaseName ScriptProperty System.Object BaseName {get=if ($this.Extension.Length -gt 0){$this.Name.Re... VersionInfo ScriptProperty System.Object VersionInfo {get=[System.Diagnostics.FileVersionInfo]::GetVer... You can sort by any of these. And each object has even more methods available, like Delete(), Encrypt() or SetAccessControl(). Examples of formatting: https://technet.microsoft.com/en-us/library/dd347677.aspx https://technet.microsoft.com/en-us/library/dd347677.aspx.