3 ms·

OK, I would like you to introduce me to a programming language where installing source code downloaded from an untrusted website on the internet does not come w

• jacques_chester 16y ago
  Sure. The JVM was engineered to include sandboxing for unsafe functions (disk access, for example). Lua allows quite granular sandboxing (look at what WoW takes away).
  • pak 16y ago
    And that sort of sandboxing would prevent a theme from hiding some spammy HTML in its code? I can think of many ways to do that, some of which don't even involve templating-level functions and just rely on the HTML level alone. You're comparing apples and oranges here. You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code. The only problem here is one of misplaced trust (and perhaps WordPress allowing PHP in templates instead of using a dedicated templating language). People installing WordPress templates generally a) don't care where they come from and b) don't even read the source code, so this theme could probably include such links without any obfuscation and still successfully spread.
    • jacques_chester 16y ago
      > And that sort of sandboxing would prevent a theme from hiding some spammy HTML in its code? No, but the problem is that the spammy code is being obfuscated using eval() and base64 encoding. > You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code. Sure, so why have other unsafe methods? I agree that social attacks cannot be completely prevented through technical means, but there's no reason to make it easy.