Hacker News Reader

Would you remove the ability to load libraries, too? Because that's as dangerous as eval when it comes to purposely writing code to run external commands. The ability of a programming language to run code is not the cause of the problem, it's having domain-breaking misleading functions like a string replacer that can compile and execute.

View on HN

yeah because libraries, which is available for scrutiny of a community (and you), is the same as a function that can run any arbitrary code in your program at runtime.

If you can load libraries at runtime, you can load a secret malicious library, or replace a standard library with arbitrary code before triggering the loading.

So would you remove that ability to avoid its exploitation potential by malware?

Reply on news.ycombinator.com