love.filesystem.isDirectory in higher levels

Questions about the LÖVE API, installing LÖVE and other support related questions go here.
Forum rules
Before you make a thread asking for help, read this.
User avatar
slime
Solid Snayke
Posts: 3162
Joined: Mon Aug 23, 2010 6:45 am
Location: Nova Scotia, Canada
Contact:

Re: love.filesystem.isDirectory in higher levels

Post by slime »

Robin wrote:
slime wrote:If you're concerned about malware hidden in a program, then the "security hazard" of allowing love.filesystem real access to the filesystem is much much less than the fact that you can download anything you want from the internet with luasocket and run terminal commands with os.execute/io.popen.
That's why SELÖVE disables os.execute and io.popen as well. Luasocket is not a problem on itself.
slime wrote:There's no reason to restrict a useful feature because you're scared of something that will happen regardless of whether the feature is there or not.
What is useful is debatable. And as for "something that will happen": SELÖVE is as far as I know completely secure in it's current state. (With much thanks to bartbes.)
slime wrote:I believe PhysFS (which is what LÖVE uses) is designed to be crossplatform, so it would be ideal for this.
Yes, so it would be foolish to use a third party library to try to replace it.
Exactly my point. You carry on using SELÖVE, and the rest of us who want useful features should be able to have them. I doubt it would be too hard to restrict love.filesystem within SELÖVE if it's opened up to the rest of us.
G.o.D
Prole
Posts: 8
Joined: Wed Aug 17, 2011 6:15 am

Re: love.filesystem.isDirectory in higher levels

Post by G.o.D »

Robin wrote: Not in SELÖVE you can't, and with good reason. While LÖVE malware is pretty rare right now, it does exist, and with our forumwide habit of downloading and running every .love we come across, that's a pretty big security hazard.
well, that means... if i am a evil programmer, i go for glbasic or purebasic and still can do my evil software - because these are actual game development environments that let handle security by the operating system as it should be, but if - and thats the case for me - i want to develop a open source application to build and test complete physics levels for love, that loads images and saves the levels outside of my level editor application directory or usually hidden user directories, then that project is hereby canceled before it started.
Post Reply

Who is online

Users browsing this forum: Google [Bot] and 1 guest