Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!1.eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Paul Rubin Newsgroups: comp.lang.python Subject: Re: Creating a reliable sandboxed Python environment Date: Fri, 29 May 2015 11:30:34 -0700 Organization: A noiseless patient Spider Lines: 23 Message-ID: <87lhg7xmlx.fsf@jester.gateway.sonic.net> References: <60b424a2-2273-42b2-b60c-92656af0afa5@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx02.eternal-september.org; posting-host="6ccd71891c5af5a40d6c4fb25cbad45d"; logging-data="13639"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19FOcel2QC5+zeKJENgqykt" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) Cancel-Lock: sha1:JnFGXOrar9HI+BjroyTKp/DqVis= sha1:GGNujLCl1iVdqQoVtFYoWEJyxic= Xref: csiph.com comp.lang.python:91493 Chris Angelico writes: >> It doesn't add much to your application to embed Lua > Lua's a much weaker language than Python is, though. Can it handle > arbitrary-precision integers? Unicode? Dare I even ask, > arbitrary-precision rationals (fractions.Fraction)? Security comes at > a price, I guess. The language features are an orthogonal issue to embeddability. Lua is easier to embed securely because its embedding interface was designed for that. It's also easy to call C functions from Lua, so if you want arbitrary precision integers or rationals, you can link GMP into your application use it from your Lua scripts. As another example, Javascript is as powerful as Python (though worse in many ways due to misdesign), but also by now supports reasonably secure embedding (or else it wouldn't be usable in browsers). See http://lucumr.pocoo.org/2014/8/16/the-python-i-would-like-to-see/#the-damn-interpreter for Armin Ronacher's comments on CPython's not-so-great embedding interface. The interface he contrasts it with is essentially how Lua and Javascript (at least in some implementations) work. I haven't looked at MicroPython or PyPy.