Inklings: a tumblelog

Concerns the recent YAML parser security issues in Rails. This I thought was worth quoting:

BTW, this whole circus reminded me of Allen Short’s excellent lightning talk from PyCon 2010: Big Brother’s Design Rules (skip to 17:30). To summarize Allen’s pithy maxims:

• War is Peace: assume you are at war, all input is an attack, and then you can be at peace.
• Slavery is Freedom: the more you constrain your code’s behavior, the more freedom you have to act. The smaller your interface, the smaller your attack surface.
• Ignorance is Strength: the less your code knows about, the fewer things it can break. This is the principle of least authority.