4 ms·

> you have a third option [...] you store your text data as a lisp program. And now anyone with access to a "text" file can run arbitrary code. Or am I missing

> you have a third option [...] you store your text data as a lisp program. And now anyone with access to a "text" file can run arbitrary code. Or am I missing something?

captaincrowbar 13y ago
If I'm reading the "Beyond Logs" section right, he seems to think that's a feature, not a bug.
- krapp 13y ago
  A Lisper will think Lisp is a feature and everything not Lisp is a bug, pretty much by definition.
- hderms 13y ago
  I mean, log files less-so, but having a config file written in a DSL of sorts can be quite a boon. In the ruby world I've found this type of pattern to be quite useful.
voyou 13y ago
And now you have to debug your log files (don't worry, though, the log files log their operation so any bugs will be easy to track down).
- yk 13y ago
  Since you can execute the log-log files, you can built a automated test system directly into them. So you can have unit tests which quickly expose any problem. ( I am mostly convinced that this way lies madness, but on the other hand...)
  - mcguire 13y ago
    "but on the other hand..." This is how you can tell that madness lies that way.
nnq 13y ago
You are missing that by "reading" the code in Lisp you don't also "execute it", you can just read it and have a nice tree data structure. If you have any reason to eval it, go ahead, but that would be a bad idea for a log or a config file (unless you want a Turing complete configuration or logging DSL... hopefully you know this is a bad idea!) Most other languages don't have an obvious way to just parse a file of source code without actually executing it: `#include <stdio.h>` or `import mycoolpythonlib` or `require __DIR__ . '/goolib.php'` both parse and execute/compile/link the file, so yes, any config/log file becomes a code file and "arbitrary code" gets executed, but it doesn't have to be this way. (Now, you have things like "import hooks" and access to the AST in Python for example if you want a tree of the imported file, but nothing "simple" and obvious. And this is the thing actually: as much as people consider Lisps too complex and powerful, the nice thing is how "obvious" and "simple" they make things like this - by just parsing sexp tree and manioulating nested lists instead of inventing a file format like XML with its transformation languages, query languages and so on, and all the tools to support them, and all the man-years (or is it decades? ...centuries?) spend to code and maintain them ...just think how much needless effort could have been spared.)
- saw-lau 13y ago
  Now you've kick-started me to start looking at 'Land of LISP' which has been sitting on my shelf for a number of years...
  - joeevans1000 13y ago
    +1 that's one of the most awesome books out there.
  - nnq 13y ago
    Glad to have resparked the interest. But as cute and witty its comics may be, I couldn't stand Land of LISP and abandoned it after ~25%... not "dense" enough for me I guess. Practical Common Lisp is what grabbed me finally (it's available for free online http://www.gigamonkeys.com/book/ http://www.gigamonkeys.com/book/ or you can buy the print), and you'll love it if you more "to the point" and practical examples.

> you have a third option [...] you store your text data as a lisp program. And now anyone with access to a "text" file can run arbitrary code. Or am I missing something?

captaincrowbar 13y ago

If I'm reading the "Beyond Logs" section right, he seems to think that's a feature, not a bug.

krapp 13y ago
A Lisper will think Lisp is a feature and everything not Lisp is a bug, pretty much by definition.
hderms 13y ago
I mean, log files less-so, but having a config file written in a DSL of sorts can be quite a boon. In the ruby world I've found this type of pattern to be quite useful.

voyou 13y ago

And now you have to debug your log files (don't worry, though, the log files log their operation so any bugs will be easy to track down).

yk 13y ago
Since you can execute the log-log files, you can built a automated test system directly into them. So you can have unit tests which quickly expose any problem. ( I am mostly convinced that this way lies madness, but on the other hand...)
- mcguire 13y ago
  "but on the other hand..." This is how you can tell that madness lies that way.

nnq 13y ago

You are missing that by "reading" the code in Lisp you don't also "execute it", you can just read it and have a nice tree data structure. If you have any reason to eval it, go ahead, but that would be a bad idea for a log or a config file (unless you want a Turing complete configuration or logging DSL... hopefully you know this is a bad idea!) Most other languages don't have an obvious way to just parse a file of source code without actually executing it: `#include <stdio.h>` or `import mycoolpythonlib` or `require __DIR__ . '/goolib.php'` both parse and execute/compile/link the file, so yes, any config/log file becomes a code file and "arbitrary code" gets executed, but it doesn't have to be this way. (Now, you have things like "import hooks" and access to the AST in Python for example if you want a tree of the imported file, but nothing "simple" and obvious. And this is the thing actually: as much as people consider Lisps too complex and powerful, the nice thing is how "obvious" and "simple" they make things like this - by just parsing sexp tree and manioulating nested lists instead of inventing a file format like XML with its transformation languages, query languages and so on, and all the tools to support them, and all the man-years (or is it decades? ...centuries?) spend to code and maintain them ...just think how much needless effort could have been spared.)

saw-lau 13y ago
Now you've kick-started me to start looking at 'Land of LISP' which has been sitting on my shelf for a number of years...
- joeevans1000 13y ago
  +1 that's one of the most awesome books out there.
- nnq 13y ago
  Glad to have resparked the interest. But as cute and witty its comics may be, I couldn't stand Land of LISP and abandoned it after ~25%... not "dense" enough for me I guess. Practical Common Lisp is what grabbed me finally (it's available for free online http://www.gigamonkeys.com/book/ http://www.gigamonkeys.com/book/ or you can buy the print), and you'll love it if you more "to the point" and practical examples.