Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

To be fair, your suggestion might make for a more resilient default, but it's also a great way to leak data and add overhead for the default case. There are tradeoffs.


Not much overhead, I would think. We’re talking about literal strings in source code, not strings in general. It’s not much work to check those.

One thing that it would break is that strings read from files would be treated differently from those in source code, even those read from files that logically “belong” to the application (say config file)

I don’t think that’s an issue, though.

Also, in Swift "\(foo)" does string interpolation. I haven’t seen people complain it leaks data or makes Swift slow (but then, it’s not fast at compiling at all because of its rather complicated type inference)


> Also, in Swift "\(foo)" does string interpolation. I haven’t seen people complain it leaks data or makes Swift slow (but then, it’s not fast at compiling at all because of its rather complicated type inference)

I think that the claim is not that this leaks data in an absolute sense, but rather that changing the behaviour after people have come to rely on it will leak data from currently well behaving applications.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: