Hacker News Reader

Just curious, how many points does your comment have right now even though it's completely wrong? I'm not insulting you for making a tiny mistake, I'm wondering why a 7 hour old post with multiple 6 hour old corrections attached to it still has a positive score.

View on HN

because eval is the real source of the problem

Would you remove the ability to load libraries, too? Because that's as dangerous as eval when it comes to purposely writing code to run external commands. The ability of a programming language to run code is not the cause of the problem, it's having domain-breaking misleading functions like a string replacer that can compile and execute.

yeah because libraries, which is available for scrutiny of a community (and you), is the same as a function that can run any arbitrary code in your program at runtime.

If you can load libraries at runtime, you can load a secret malicious library, or replace a standard library with arbitrary code before triggering the loading.

So would you remove that ability to avoid its exploitation potential by malware?

Reply on news.ycombinator.com