4 ms·

Thank you for this! Interestingly, the cases you mention cannot arise in Prolog, because Prolog terms are never evaluated implicitly. They are just terms, and y

by zmonx 9y ago

Thank you for this! Interestingly, the cases you mention cannot arise in Prolog, because Prolog terms are never evaluated implicitly. They are just terms, and you write predicates that reason over them. In pure Prolog, there is no way to pass something "by reference" either. If you are determined enough, you can definitely write an unsafe library or app also in Prolog, and security mistakes are also routinely found in Prolog implementations, just as in PHP or Java implementations. The main point is still though that a large class of security issues that easily arise in PHP user programs by one of the ways you mention is far, far less likely to occur in Prolog programs, due to the more direct, symbolic way you reason about data in Prolog, and additional mechanisms such as the mentioned quasiquotations which allow safe embeddings.

nickpsecurity 9y ago
" The main point is still though that a large class of security issues that easily arise in PHP user programs by one of the ways you mention is far, far less likely to occur in Prolog programs" This is true. While we're at it, I think it's worth bringing up that the most powerful use of Prolog is embedding it in a LISP that is "batteries included." One like Racket. That way, one can use a safe, easy-to-analyze, functional style for most of the application, one or more DSL's for the templating (esp HTML), and Prolog operating on LISP structures when Prolog is best thing to handle it with. Alternatively, Shen uses something like Prolog as its type system so you can hand-roll a custom, type system for each component which might include security properties. Far as good design, web, and security-oriented, the best I've seen is Opa language for doing that plus being productive. http://opalang.org/ http://opalang.org/ Too bad they moved the backend to Node. Probably to latch onto an ecosystem getting momentum which is a lesson from Worse is Better philosophy. Most IT tech that didn't disappeared into history at some point. I'd have preferred it be Go if one of the new, popular things given its fast, simpler, and safe enough. Hell, if libraries aren't a concern, they can even output safe subset of C with all the checks enabled like Pieter Hintjens did with iMatix DSL's.
- ScottBurson 9y ago
  I thought Opa looked very interesting when I first heard about it, but I don't see much recent activity on the GitHub repo. Is it still alive?
  - nickpsecurity 9y ago
    I didn't even realize the last blog post as Sep 2013: http://blog.opalang.org/ http://blog.opalang.org/ Hell, it might be dead. I'll have to email them some time this week to find out what's up. Fortunately, it's open-source so others can pick up where they left off if they want. Or do a clean-slate work with similar capabilities.
  - nickpsecurity 9y ago
    Got word from a developer that the project is on hold. He claimed no residual vulnerabilities since it extracts to Node.js which is maintained. He said dome are using it in production. They still welcome contributors. Yeah, it seems dead for now.

by zmonx 9y ago

nickpsecurity 9y ago

" The main point is still though that a large class of security issues that easily arise in PHP user programs by one of the ways you mention is far, far less likely to occur in Prolog programs" This is true. While we're at it, I think it's worth bringing up that the most powerful use of Prolog is embedding it in a LISP that is "batteries included." One like Racket. That way, one can use a safe, easy-to-analyze, functional style for most of the application, one or more DSL's for the templating (esp HTML), and Prolog operating on LISP structures when Prolog is best thing to handle it with. Alternatively, Shen uses something like Prolog as its type system so you can hand-roll a custom, type system for each component which might include security properties. Far as good design, web, and security-oriented, the best I've seen is Opa language for doing that plus being productive. http://opalang.org/ http://opalang.org/ Too bad they moved the backend to Node. Probably to latch onto an ecosystem getting momentum which is a lesson from Worse is Better philosophy. Most IT tech that didn't disappeared into history at some point. I'd have preferred it be Go if one of the new, popular things given its fast, simpler, and safe enough. Hell, if libraries aren't a concern, they can even output safe subset of C with all the checks enabled like Pieter Hintjens did with iMatix DSL's.

ScottBurson 9y ago
I thought Opa looked very interesting when I first heard about it, but I don't see much recent activity on the GitHub repo. Is it still alive?
- nickpsecurity 9y ago
  I didn't even realize the last blog post as Sep 2013: http://blog.opalang.org/ http://blog.opalang.org/ Hell, it might be dead. I'll have to email them some time this week to find out what's up. Fortunately, it's open-source so others can pick up where they left off if they want. Or do a clean-slate work with similar capabilities.
- nickpsecurity 9y ago
  Got word from a developer that the project is on hold. He claimed no residual vulnerabilities since it extracts to Node.js which is maintained. He said dome are using it in production. They still welcome contributors. Yeah, it seems dead for now.