Hacker News Reader

The problem with most configuration file formats is: you can't put functions in them realistically.

The best configuration file is simply source code that initializes whatever you want to run, and then runs it. That way, you can install hooks in the form of closures and make the program behave exactly like you want without the constraints that a simple "value-only" configuration file format has.

View on HN

Lua was originally designed as a configuration file format that supported functions. Description: https://www.netbsd.org/~mbalmer/lua/lua_config.pdf

Relative to other languages, it is very easy to embed Lua and it is also easy to cut out Lua’s entire standard library to restrict what the scripts are capable of doing within your program.

This may be application-specific, but I might worry about security if my configuration files support arbitrary closures.

Any more so than the rest of your code?

Config files are typically written updated by non-developers and often go through a less rigorous release process, so having a less-complex and dangerous, even if less-capable, language can be desirable.

Ah, that's not been my experience - but I can understand that if non-developers are the ones making the changes

If an attacker has write access to your configuration files, isn't all lost already?

Reply on news.ycombinator.com