Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>Do me a favor, please do not write your configuration files in Clojure as well.

Code is data and data is code. For Lisp programs, configuration is just another Lisp program. I don't want my Lisp programs crippled by a "dumb" config file.



If your configuration file is a Lisp file, then it's not a configuration file. It's a distributed portion of your program which is wide open to being destroyed by a sysadmin. "What do you mean I took down the site by adding a TLS parameter to the config file? How could a config file overwrite a function symbol in your code?!"

What a config file should be is the simplest, most easy to read and fill out configuration file you can possibly think of. It should be tolerant of simple formatting mistakes and be targeted at someone who is not as smart as you are.

It should also never contain executable code, because config files are rarely as well protected on a system as executable code is, and this could lead to some really nasty vulnerabilities if it's exploited.


This is the case with all config files, though, regardless how simple. The incident where Google accidentally blacklisted the entire Internet [1] was because of a one-character typo in a config file.

The lesson you should learn from this is not to never include powerful statements or interpreted strings in config files, it's that you should test your configs as if they were code, because mistakes in them are just as dire. Even if you limit yourself to key/values in a .properties file, you can still bring down the site if you typo a filesystem path or database name.

[1] http://www.theguardian.com/technology/2009/jan/31/google-bla...


The most common way to do this in Clojure is to use an EDN file. EDN is similar to Clojure syntax but the EDN reader (intentionally) has no arbitrary runtime execution functionality - it just reads a data structure and returns it.


>Code is data and data is code.

This is true. It does not follow, however, that the concept of code and data is meaningless. Ask anyone who's had to deal with user data unserializing into executable code whether the truth you speak is a blessing or a curse.

> I don't want my Lisp programs crippled by a "dumb" config file. Why should a config file not be "dumb?"

The purpose of a config file is to store state. Why should that be Turing complete? What purpose would it serve?


>Why should that be Turing complete? What purpose would it serve?

Ever see an Emacs config file?


One or two.

I understand the temptation to add evaluation and expressions to everything, but beyond a certain complexity, you no longer have a config file, you're just exposing variables from an application within an application.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: