News for hackers. Stuff that matters.

A comment on iOS 12 uses Lua code downloaded from Apple's servers. Parent comment

Re:iOS 12 uses Lua code downloaded from Apple's servers by sbjs on Monday August 06, 2018 @03:51PM (#17701124)
One purpose for making Swift was because Objective C is dynamic, and they thought they could get a speed boost by going fully static. The other is because they were having a hard time evolving a C-based language because C is full of plot holes. Swift is meant to be efficient but still allow abstractions, which C is really bad at. (The best you can get with C is leaky abstractions.)

This should be dynamic, but it shouldn't be LUA. It should be something like JSON. Although Lua is sandboxed, so it's safer that way, it is still an easier and bigger attack vector for hackers than JSON would be.

[ Parent | on HN ]
Re:iOS 12 uses Lua code downloaded from Apple's servers by wereHamster on Monday August 06, 2018 @04:10PM (#17701308)
Do you really believe that if Apple wrote their own interpreter for their own custom language that serializes into JSON it would be safer than using one of the battle-tested LUA implementations?
[ Parent | on HN ]
Re:iOS 12 uses Lua code downloaded from Apple's servers by stcredzero on Monday August 06, 2018 @07:33PM (#17702687)
Lua, not LUA. It's Portugese for moon.
[ Parent | on HN ]
Re:iOS 12 uses Lua code downloaded from Apple's servers by sbjs on Monday August 06, 2018 @04:23PM (#17701432)
I was suggesting that they don't have executable code at all, that they use static configuration. But it may not be possible within their problem domain, I don't know. I always prefer static solutions until dynamic becomes necessary.
[ Parent | on HN ]
Re:iOS 12 uses Lua code downloaded from Apple's servers by crgwbr on Monday August 06, 2018 @08:50PM (#17703050)
Between code signing and sandboxing, this probably isn’t any more dangerous than the JS that Safari downloads and runs every time you open a webpage.
[ Parent | on HN ]
Re:iOS 12 uses Lua code downloaded from Apple's servers by earenndil on Monday August 06, 2018 @10:40PM (#17703532)
C gives you technically perfect abstractions, but it's a pita: you have to mess around with unimplemented structs (`typedef struct Bla Bla`, but never actually define Bla in the public interface, and then have functions taking Bla*), and void pointers, which generally makes it significantly less comfortable than in higher-level-languages.
[ Parent | on HN ]