Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.forth > #56454
| From | anton@mips.complang.tuwien.ac.at (Anton Ertl) |
|---|---|
| Newsgroups | comp.lang.forth |
| Subject | Re: What's so great about Forth, anyway? |
| Date | 2017-03-29 13:58 +0000 |
| Organization | Institut fuer Computersprachen, Technische Universitaet Wien |
| Message-ID | <2017Mar29.155813@mips.complang.tuwien.ac.at> (permalink) |
| References | (3 earlier) <369964a5-1eeb-4b45-b928-6618f787faec@googlegroups.com> <94928949-4713-4ec5-83ac-18392ce435ab@googlegroups.com> <6e4526f5-0e12-407d-b46d-cc0addb0e10d@googlegroups.com> <2017Mar29.135353@mips.complang.tuwien.ac.at> <obg800$q7l$1@dont-email.me> |
Ron Aaron <rambamist@gmail.com> writes:
>
>
>On 03/29/17 14:53, Anton Ertl wrote:
>> Julian Fondren <julian.fondren@gmail.com> writes:
>>> he's talking about a language that can load
>>> and compile arbitrary code without that code behaving maliciously...
>
>> I think that's pretty hard. Java tried and failed. JavaScript also
>> fails, but is so popular that people don't want to admit it. Running
>> the application in an appropriately restricted OS-level virtual
>> machine looks more promising, but also has its pitfalls.
>
>It depends on what you mean.
>
>8th already restricts (arbitrary) access to memory
So does Java.
>It's easy to make it impossible for arbitrary code to access any words
>outside a designated namespace, using "only".
ONLY does not help general Forth (e.g., you can just EXECUTE anything
without needing access through the name), and if you restrict the
words, you have to be very careful to avoid leaving a hole. And if
you succeed, you do not load arbitrary Forth code, but a heavily
restricted variant.
>It's easy to handle arbitrary input if you don't hand it over to "eval"
>(for instance).
Loading and compiling arbitrary code as Julien Fondren required means
that you have to hand it over to something like EVALIUATE.
Even if you drop that requirement, myriads of vulnerabilities written
in languages that don't have anything like EVALUATE demonstrate that
it is not easy.
>8th is "strongly typed", and doesn't have "casting". So you can't make
>an end-run around type protections.
>
>And 8th doesn't let you manipulate the return address with >r etc.
>Instead, the "r" words simply manipulate an auxiliary stack.
Likewise, in Java, and yet the Java applet mechanism was so full of
holes that they eventually abandoned it. Java without the applet
requirement to allow the attacker to provide the code is probably not
worse than anything else, though (e.g., it still suffers from calling
libraries written in C that contain vulnerabilities).
- anton
--
M. Anton Ertl http://www.complang.tuwien.ac.at/anton/home.html
comp.lang.forth FAQs: http://www.complang.tuwien.ac.at/forth/faq/toc.html
New standard: http://www.forth200x.org/forth200x.html
EuroForth 2016: http://www.euroforth.org/ef16/
Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
What's so great about Forth, anyway? Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-03-14 13:07 -0500
Re: What's so great about Forth, anyway? Julian Fondren <julian.fondren@gmail.com> - 2017-03-14 11:54 -0700
Re: What's so great about Forth, anyway? rickman <gnuarm@gmail.com> - 2017-03-14 15:53 -0400
Re: What's so great about Forth, anyway? Julian Fondren <julian.fondren@gmail.com> - 2017-03-14 19:24 -0700
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-15 10:00 +0000
Re: What's so great about Forth, anyway? rickman <gnuarm@gmail.com> - 2017-03-15 12:57 -0400
Re: What's so great about Forth, anyway? Julian Fondren <julian.fondren@gmail.com> - 2017-03-15 11:09 -0700
Re: What's so great about Forth, anyway? Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-03-16 04:05 -0500
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-16 09:41 +0000
Re: What's so great about Forth, anyway? hughaguilar96@gmail.com - 2017-03-16 10:57 -0700
Re: What's so great about Forth, anyway? rickman <gnuarm@gmail.com> - 2017-03-16 14:41 -0400
Re: What's so great about Forth, anyway? hughaguilar96@gmail.com - 2017-03-15 11:34 -0700
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-03-22 03:24 -0700
Re: What's so great about Forth, anyway? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-22 11:24 -1000
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-03-23 14:51 -0700
Re: What's so great about Forth, anyway? Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-03-23 04:25 -0500
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-03-23 14:58 -0700
Re: What's so great about Forth, anyway? Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-03-24 03:03 -0500
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-03-24 04:52 -0700
Re: What's so great about Forth, anyway? Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-03-24 09:06 -0500
Re: What's so great about Forth, anyway? Julian Fondren <julian.fondren@gmail.com> - 2017-03-23 07:47 -0700
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-25 17:13 +0000
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-03-28 13:48 -0700
Re: What's so great about Forth, anyway? Brad Eckert <hwfwguy@gmail.com> - 2017-03-28 18:34 -0700
Re: What's so great about Forth, anyway? Julian Fondren <julian.fondren@gmail.com> - 2017-03-28 18:52 -0700
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-29 11:53 +0000
Re: What's so great about Forth, anyway? Ron Aaron <rambamist@gmail.com> - 2017-03-29 15:09 +0300
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-29 13:58 +0000
Re: What's so great about Forth, anyway? Ron Aaron <rambamist@gmail.com> - 2017-03-29 17:24 +0300
Re: What's so great about Forth, anyway? The Beez <the.beez.speaks@gmail.com> - 2017-04-04 03:04 -0700
Re: What's so great about Forth, anyway? Ron Aaron <rambamist@gmail.com> - 2017-04-04 15:30 +0300
Re: What's so great about Forth, anyway? The Beez <the.beez.speaks@gmail.com> - 2017-04-06 05:36 -0700
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-04-04 16:35 +0000
Re: What's so great about Forth, anyway? hughaguilar96@gmail.com - 2017-04-05 11:46 -0700
Re: What's so great about Forth, anyway? "Elizabeth D. Rather" <erather@forth.com> - 2017-03-28 16:12 -1000
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-29 11:59 +0000
Re: What's so great about Forth, anyway? anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-03-29 10:24 +0000
Re: What's so great about Forth, anyway? franck.bensusan@gmail.com - 2017-04-04 04:05 -0700
Re: What's so great about Forth, anyway? gavino himself <jackvanc3@gmail.com> - 2017-03-22 13:18 -0700
Re: What's so great about Forth, anyway? NN <november.nihal@gmail.com> - 2017-03-14 12:20 -0700
Re: What's so great about Forth, anyway? gavino himself <jackvanc3@gmail.com> - 2017-04-02 19:52 -0700
Nothing's great about Forth "Robert L." <No_spamming@noWhere_7073.org> - 2017-04-04 10:45 +0000
Re: Nothing's great about Forth Julian Fondren <julian.fondren@gmail.com> - 2017-04-04 08:00 -0700
Re: Nothing's great about Forth lehs <skydda.barnen@gmail.com> - 2017-04-04 08:16 -0700
Re: Nothing's great about Forth Mark Wills <markwills1970@gmail.com> - 2017-04-04 09:11 -0700
Re: Nothing's great about Forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-04-06 06:42 -0700
csiph-web