[erlang-questions] A less trusting Erlang.
Mon Oct 12 06:21:51 CEST 2009
The short answer is that you can't effectively prevent a node in a
distributed erlang setup from doing just about anything it wants to
another node. It just doesn't work that way. There was some effort a
while back to try to deal with these issues (see the SSErl work and a
long thread on the list from the summer of 2006 relating to E/Erlang
integration) but nothing concrete has come of it.
You are better off using a well-defined protocol at the trust
boundaries and not trying to let untrusted users make calls directly
into the trusted side of this boundary.
On Sun, Oct 11, 2009 at 2:55 PM, Calum <caluml@REDACTED> wrote:
> I'd like to use Erlang, and the built-in distributed meshing effect of
> it to build a sort of IRC-plus distributed storage/messaging system
> platform, of which each node would run the Erlang app.
> However, I'd like to use avoid using lib_chan if possible, and just
> use the native Erlang connectivity/distribution mechanisms.
> The big problem then is that Erlang is way too trusting for connecting
> to random people in the default
> if-you-know-my-cookie-you-can-do-whatever-you-like mode.
More information about the erlang-questions