Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've been meaning to ask this about some of the less harmful software listed:

1. What advantages and disadvantages would you say rc has for daily use as an interactive shell over {ksh,bash,zsh}? How does it compare for scripting to those shells and Tcl? I don't know if this is historically true for the latter but both rc and Tcl strike me as regularizations of the Bourne shell syntax and semantics, albeit ones that went different ways (everything including code is a string in Tcl but not in rc, which leads to further differences).

2. What is the the closest equivalent of PQ for Linux/*BSD? Best if it also supports updates. There is surprising little about PQ on the Web, basically just http://www.plan9.bell-labs.com/wiki/plan9/pq/ and http://plan9.bell-labs.com/wiki/plan9/Using_PQ/.

Edit: 3. A downside to PostScript is that it is a Turing-complete programming language. Defining a subset of it that gets rid of flow control would make it too verbose and harder than necessarily to write by hand. By contrast, in SVG it's easy to never use the <script> tag unless you want animation. Is there a (semi-)standard vector graphics markup format simpler than SVG that's purely declarative? I couldn't find one.



>A downside to PostScript is that it is a Turing-complete programming language. Defining a subset of it that gets rid of flow control would make it too verbose and harder than necessarily to write by hand ... Is there a (semi-)standard vector graphics markup format simpler than SVG that's purely declarative? I couldn't find one.

I was under the impression that PDF is a Turing-incomplete subset of PostScript in a pre-processed form. No idea how fun it would be to manually create PDFs, but apparently you can convert PostScript documents to PDFs easily by recording the drawing commands that your document produces as it renders/executes.

https://en.wikipedia.org/wiki/Portable_Document_Format#PostS...


The section of the Fount of All Truth (Wikipedia) to you refer to doesn't seem to say that PDF is in fact Turing-complete. In fact it makes it sound like PDF is the result of running a PS document to completion and then taking a "screenshot" of the result. ("Screenshot" as in a snapshot of all the rendered primitives, curves, text, etc.)


read carefully: Turing-INcomplete


I used to use rc on Linux. The details are hazy, but the two main things I remember are:

1. There were lots of little compatibility problems. ssh-agent and gpg-agent can output either Bourne shell or csh. rc can't parse either. I also had trouble with using rc as shell in Vim, something to do with the different quoting rules of rc IIRC.

(This wouldn't be problems when using rc in its native Plan 9 environment of course.)

2. I can't live without readline.


> A downside to PostScript is that it is a Turing-complete programming language

I could be guessing, but why exactly do you say it's a downside?


PostScript is dangerous as a vector of attack. You can create an infinite loop as a DoS. Way back in the NeXT days, you could get remote control a system with an invisible block of postscript put in an email, turning on microphones and cameras and dumping that data to hosts. It became a nightmare to secure. The DOD physically destroyed those inputs on their black hardware to deal with it. Apple moved to DisplayPDF for license cost reasons primarily, but security and performance were also factors.


But the only one of those problems that is due to it being a Turing-complete language is the infinite loops, the other ones are just a question of the mail client exposing sensitive capabilities to untrusted code (which it should not do, of course).

As for infinite loops, SVG allows you to make definitions and refer back to them, so you can write documents which take exponential time (in the document size) to render --- in practice that is as big a DoS attack. And the way to deal with it is the same, you need to impose resource limits when rendering files given to you by an untrusted attacker.

It seems that Postscript the language got an bad reputation for kindof unfair reasons: the toolset was written assuming that files were generated by friendly people, and then those tools were run an arbitrary code from the internet. But it is totally possible to write a Postscript interpreter which runs code in isolation, just as you can for Java or Javascript.


Not being sure your document is going to finish rendering isn't ideal.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: