5 ms·

You probably know this, but remember that storing user data as code is a place where you (general "you") have to think very carefully about security. Is there

by JackC 13y ago

You probably know this, but remember that storing user data as code is a place where you (general "you") have to think very carefully about security. Is there any way that arbitrary code in the file could compromise the user's system? If so, does the user know to treat these data files as executables? Is there any way someone untrusted could ever edit the file without the user's knowledge? Even in combination with other programs the user might be running? Are you sure about all of that? Maybe Lua in particular is sandboxed so that's not a problem (beats me), but in general this is an area where safe high-level languages can all of a sudden turn dangerous. Personally I would rarely find it worth it.

Guvante 13y ago
Typically sandboxing is stage one of any lua implementation. You don't need raw IO access and rarely need to print to the screen for instance.
TelmoMenezes 13y ago
This is a good point, but I feel that discouraging this type of approach is not the way to go. I apologise in advance for ranting... I hope this is not too off-topic, but instead a "zoom out" on the issue. This touches on something deep and wrong about how we use computers these days. Computers are really good at being computers, and the amplification of intellectual capabilities they afford is tremendous, but this is reserved for a limited few that were persistent enough and learned enough to rediscover the raw computer buried underneath, and what it can do. For example, I dream of a world where everything communicates through s-expressions, all code is data and all data is code. Everything understandable all the way down. Imagine what people from all fields could create with this level of plug-ability and inter-operability. We had a whiff of that with the web so far, but it could be so much more powerful, so much simpler, so much more elegant. All the computer science is there, it's just a social problem. I understand the security issues, but surely limiting the potential of computers is not the solution. There has to be a better way.
- judk 13y ago
  When my conputer has the potential to erase my bank account, I want to limit its potential.
- seabee 13y ago
  In a world where users will willingly enter malicious code into their computers if they believe it will do something they want[1], can there really be a better way? [1] https://www.facebook.com/selfxss https://www.facebook.com/selfxss
  - hdevalence 13y ago
    This seems like exactly the problem the parent post is complaining about, though: the people in the limited group the parent talks about aren't the people being tricked by selfxss, it's the people who don't have the technical knowledge to understand what the developer console does and why pasting in random JS might be a bad idea. So the phenomenon of selfxss reinforces the point.
  - davb 13y ago
    Perhaps modern operating systems (or hardware?) need two modes - "Safe mode", where everything is sanitised, checked, limited and Secure Boot-style verified, and "Open mode" where it's not; where experts and enthusiasts can work without limit and without DRM.
    - Seeless 13y ago
      That only adds an extra step to the social engineering process.
      - deleted 13y ago
        [deleted]
    - kalleboo 13y ago
      Safe mode is called iOS
  - 13y ago
ufo 13y ago
Lua sandboxing is relatively straightfoward. You can choose what functinos from the standard library the script you are evaluating will see in its global scope. By passing an empty scope the only thing the evaluated script can do is build tables, concatenate strings, do arithmetic, etc. You only need to worry about DOS due to infinite loops but there are also workarounds for that). In Loa 5.1 you can use setfenv http://www.lua.org/manual/5.1/manual.html#pdf-setfenv http://www.lua.org/manual/5.1/manual.html#pdf-setfenv And in Lua 5.2 the functions that eval strings receive the global scope as an optional parameter. http://www.lua.org/manual/5.2/manual.html#pdf-loadfile http://www.lua.org/manual/5.2/manual.html#pdf-loadfile
unsigner 13y ago
Lua can be sandboxed so your data file can't call arbitrary functions (but can still call a controlled subset, e.g. a function called RGB that does r255255+g*255+b so your colors are somewhat human-readable in the file, yet 24-bit integers in memory). But it's still code, so you can e.g. inject an infinite loop and the loader will hang. (You can protect against this, you can install a debug hook that gets called after every N instructions executed, and kill the loader.)
- malkia 13y ago
  Or HashDOS attack - http://lua-users.org/wiki/HashDos http://lua-users.org/wiki/HashDos
chalst 13y ago
I trust Lua sandboxing. See, e.g.: 1. http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/1224708/how-can-i-create-... 2. http://stackoverflow.com/questions/4134114/capabilities-for-lua-what-experience-is-there http://stackoverflow.com/questions/4134114/capabilities-for-... I find it easier to trust Lua than similar facilities in other programming languages because the kernel of the language has a relatively simple semantics, so the TCB of a sandbox is lower, and the source is easier to understand than most other languages. Note that sandboxing in Lua 5.2 has a still simpler semantics than for Lua 5.1 - few other languages evolve in a way that makes the language easier to trust.
- malkia 13y ago
  It's the halting problem - all it takes for someone to embed in your data code that loops forever (wait infinite), or recurses (crash), or discover some vulnerability... Not directly related to saving files as lua, but say as bytecode: https://www.youtube.com/watch?v=OSMOTDLrBCQ https://www.youtube.com/watch?v=OSMOTDLrBCQ
mrcharles 13y ago
Aware of all the issues and already have a plan. But Lua generally only has access to the APIs you give it; from game code our Lua VM has no access to the OS at all, just game functions, and those game functions are never system related. The biggest 'concern' would be save hacking, but at the end of the day that will happen no matter what so it doesn't bother me much.

by JackC 13y ago

Guvante 13y ago

Typically sandboxing is stage one of any lua implementation. You don't need raw IO access and rarely need to print to the screen for instance.

TelmoMenezes 13y ago

This is a good point, but I feel that discouraging this type of approach is not the way to go. I apologise in advance for ranting... I hope this is not too off-topic, but instead a "zoom out" on the issue. This touches on something deep and wrong about how we use computers these days. Computers are really good at being computers, and the amplification of intellectual capabilities they afford is tremendous, but this is reserved for a limited few that were persistent enough and learned enough to rediscover the raw computer buried underneath, and what it can do. For example, I dream of a world where everything communicates through s-expressions, all code is data and all data is code. Everything understandable all the way down. Imagine what people from all fields could create with this level of plug-ability and inter-operability. We had a whiff of that with the web so far, but it could be so much more powerful, so much simpler, so much more elegant. All the computer science is there, it's just a social problem. I understand the security issues, but surely limiting the potential of computers is not the solution. There has to be a better way.

judk 13y ago
When my conputer has the potential to erase my bank account, I want to limit its potential.
seabee 13y ago
In a world where users will willingly enter malicious code into their computers if they believe it will do something they want[1], can there really be a better way? [1] https://www.facebook.com/selfxss https://www.facebook.com/selfxss
- hdevalence 13y ago
  This seems like exactly the problem the parent post is complaining about, though: the people in the limited group the parent talks about aren't the people being tricked by selfxss, it's the people who don't have the technical knowledge to understand what the developer console does and why pasting in random JS might be a bad idea. So the phenomenon of selfxss reinforces the point.
- davb 13y ago
  Perhaps modern operating systems (or hardware?) need two modes - "Safe mode", where everything is sanitised, checked, limited and Secure Boot-style verified, and "Open mode" where it's not; where experts and enthusiasts can work without limit and without DRM.
  - Seeless 13y ago
    That only adds an extra step to the social engineering process.
    - deleted 13y ago
      [deleted]
  - kalleboo 13y ago
    Safe mode is called iOS
- 13y ago

ufo 13y ago

Lua sandboxing is relatively straightfoward. You can choose what functinos from the standard library the script you are evaluating will see in its global scope. By passing an empty scope the only thing the evaluated script can do is build tables, concatenate strings, do arithmetic, etc. You only need to worry about DOS due to infinite loops but there are also workarounds for that). In Loa 5.1 you can use setfenv http://www.lua.org/manual/5.1/manual.html#pdf-setfenv http://www.lua.org/manual/5.1/manual.html#pdf-setfenv And in Lua 5.2 the functions that eval strings receive the global scope as an optional parameter. http://www.lua.org/manual/5.2/manual.html#pdf-loadfile http://www.lua.org/manual/5.2/manual.html#pdf-loadfile

unsigner 13y ago

Lua can be sandboxed so your data file can't call arbitrary functions (but can still call a controlled subset, e.g. a function called RGB that does r255255+g*255+b so your colors are somewhat human-readable in the file, yet 24-bit integers in memory). But it's still code, so you can e.g. inject an infinite loop and the loader will hang. (You can protect against this, you can install a debug hook that gets called after every N instructions executed, and kill the loader.)

malkia 13y ago
Or HashDOS attack - http://lua-users.org/wiki/HashDos http://lua-users.org/wiki/HashDos

chalst 13y ago

I trust Lua sandboxing. See, e.g.: 1. http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/1224708/how-can-i-create-... 2. http://stackoverflow.com/questions/4134114/capabilities-for-lua-what-experience-is-there http://stackoverflow.com/questions/4134114/capabilities-for-... I find it easier to trust Lua than similar facilities in other programming languages because the kernel of the language has a relatively simple semantics, so the TCB of a sandbox is lower, and the source is easier to understand than most other languages. Note that sandboxing in Lua 5.2 has a still simpler semantics than for Lua 5.1 - few other languages evolve in a way that makes the language easier to trust.

malkia 13y ago
It's the halting problem - all it takes for someone to embed in your data code that loops forever (wait infinite), or recurses (crash), or discover some vulnerability... Not directly related to saving files as lua, but say as bytecode: https://www.youtube.com/watch?v=OSMOTDLrBCQ https://www.youtube.com/watch?v=OSMOTDLrBCQ

mrcharles 13y ago

Aware of all the issues and already have a plan. But Lua generally only has access to the APIs you give it; from game code our Lua VM has no access to the OS at all, just game functions, and those game functions are never system related. The biggest 'concern' would be save hacking, but at the end of the day that will happen no matter what so it doesn't bother me much.