Am 24.04.2012 um 11:10 schrieb Stéphane Ducasse:

>>> And yet again I point to Tirade :)
>>> 
>>> http://goran.krampe.se/blog/Squeak/Tirade.rdoc
>>> http://goran.krampe.se/blog/Squeak/Tirade2.rdoc
>>> http://goran.krampe.se/blog/Squeak/Tirade3.rdoc
>>> 
>>> Especially Tirade2 above shows a bit about size (4 classes, 500 loc) speed 
>>> and portability. Tirade is basically a parser for Smalltalk messages that 
>>> only are allowed to use literals as arguments (although arbitrarily nested 
>>> literals).
>>> 
>>> Which is exactly what Stef describes + a bit more. :)
>> 
>> Yeah, I remember reading that a long time ago. It is indeed a cool idea, 
>> Göran. Reminds me of the Erlang related UBF 
>> (http://www.sics.se/~joe/ubf/site/home.html).
>> 
>> I think the JSON choise is not bad: it is simple and universally accepted.
> 
> But you can express **EXACTLY** the same with 
>       #( 
>               
>               
>               )
> 
> So what is the point?
> 
The two points are still the same, Stef. The lesser important point was the 
absence of a cross platform parser for that format. Here I understand Dale. He 
spawns of project after project that depend on each other. I think he is not 
willing to yet postpone this project only to create such a parser when there is 
a usable alternativ. Others might create it and convince him afterwards which 
isn't very difficult if I take my experience until now. That would be the 
easier part.
The harder part is security. The security standpoints always divide between 
white lists and black lists. Meaning a white list forbids everything and allows 
things on a white list. Or vice versa you allow everything and put things you 
don't like on a black list. Having a Smalltalk format means I have two options: 
"Read and parse it" or "Read and evaluate it". As far as I understand Dale he 
sees a big problem if people just evaluate configurations which contain bogus 
code. It is just so easy to introduce code that borkes your system. 
While I really can understand the security concerns I personally think that 
having two options is better. The standard tools should just take parse route.

Norbert



Reply via email to