8 ms·
The real dependency problem is that most languages give out way too much trust by default. Any code can have any side effects. I'd like ways to guarantee my de
by Felz 8y ago
The real dependency problem is that most languages give out way too much trust by default. Any code can have any side effects.
I'd like ways to guarantee my dependencies have no side effects, like they were Haskell with no IO/unsafePerformIo, or to aggressively audit and limit those side effects. Malicious event stream package suddenly wants to use the network? No.
- beardedwizard 8y agoAnother way to state this is: accept the state of the world and approach the problem using an existing methodology - treat code as untrusted and whitelist execution paths. SElinux and others do this, intrinsic is another product that uses the same approach for app runtime, I think this is probably the future of this problem space. This is zero trust, and this pattern is showing up everywhere (again?).