What The Rails Security Issue Means For Your Startup
Code execution while deserializating / parsing data is my first and uttermost concern.  Nowadays I'm in Clojure land and it's still not entirely clear as to what I can and cannot do and what the language as to offer me so that data doesn't contain rogue code that is going to be executed.<p>In Common Lisp, for example, as far as I know you can set a flag so that the reader is set to "no evaluation ever" (if I understand things correctly) and, hence, if you're not using eval yourself specifically, nothing is ever going to be evaluated.<p>But how would that work in Clojure?  And what about other languages?  Ruby?  Haskell?  Java? C#?<p>I think the ability to execute code became <i>the</i> most important security issue (more than buffer overflow/overrun which can now be prevented --even sometimes provably impossible to happen thanks to theorem provers).<p>More thoughts should be put into explaining how/when a language / API can execute code and how it should/can be used to prevent such a thing from happening.