Hacker News new | ask | show | jobs
by remexre 2023 days ago
Your config language being turing complete doesn't work if you need to accept/validate config files from untrusted parties
3 comments

While I don't disagree, you can get rather far by limiting what you allow in the evaluation. There is no reason you have to pull it in in your current environment directly.

And then you have an easy mechanism to allow some configs from trusted parties to be a bit more capable, if they need it.

Though in that case you definitely want to disable macros for this config (as they allow for exponential time/space) and be very careful with any additional functions you expose.
edn seems like the right solution, then.

https://github.com/edn-format/edn