Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Shouldn't permissions ultimately be Turing-complete functions?

E.g. you could do fancy things like grant someone access to a folder, and also to all subdirectories whose name starts with "collaboration_".

And you can build any kind of permission system with it, if you don't like the power or complexity.



Absolutely not. Turing-complete functions are subject to Rice's Theorem - meaning that they are undecidable in the general case. Also, if it's Turing-complete then anyone can make a ridiculous mess of an area with little or no tooling. Configuration should be Turing-incomplete unless you have a very good reason to do otherwise.

Being Turing-incomplete is a valuable feature.


You haven't given an argument for why "undecidability" would be a problem in this case. Please give a compelling example.

We're not banning regular applications either because they are undecidable.

Also, we could change Turing completeness into something less powerful, for instance programs without loops.


Undecidability means loading your configuration could never complete or could consume an indeterminate amount of resources. Which means it's a security concern as a bad config can DOS your system.

This type of attack exists even without Turing-complete config but just with references: https://en.wikipedia.org/wiki/Billion_laughs_attack

> Also, we could change Turing completeness into something less powerful, for instance programs without loops.

Yes, this is a strategy. For example BPF does not support loops.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: