Subject: [clisp-list] networking

From: "Hoehle, Joerg-Cyril" <[email-masked]>
Date: Thu Feb 12 05:47:09 2004

Hi,

Alexander Schreiber wrote:
>> Much easier to use something like
>> (defun email (address string)
>>   (let ((s (ext:make-pipe-output-stream (format nil 
>"sendmail ~A" address))))
>>     (princ string s) (close s)))

>This is not a good idea. You've just gained yourself a security hole
>by not fully sanitizing the address string to avoid shell command 
>injections and you are relying on being able to use the sendmail 
>command to send mail.

OTOH, SMTP may not be what's needed, e.g. MS-Exchange could be used, or SSL transmissions. Also, the local mail may decide to store some mails locally. It makes some sense to delegate.

My point here however is that, coming from an Amiga, I've often had a horror from code which IMHO gratuitously used UNIX (or MS-windows) idioms where portable Lisp code could be used.

E.g. I've usually sent e-mail to people when I saw
(ext:shell "rm -f " filename)
and told them about #'cl:delete-file.

Similarly, having used quite different UNIX systems like SunOS, Solaris2, some Linux and *BSD, code like the above tends to work on the author's system only, because of the many different command switches and command paths.
In Emacs, there's therefore a tendency to use a lot of configuration variables, but my point is that outside of an editor, you have to provide an awful lot of the same configuration options using your application's GUI (that you thus have to write) or other means, and you need to document that.

Lots of DEFVAR in every application is not the best way to configure a system that I can think of. My thoughts much more go towards sets of autonomous agents (let's call them that way), that now well how to perform a well-defined action, e.g. send out a single e-mail. Maybe I'll see such systems put to broad use before the end.

Reality is of course, more complex. What if the agent cannot send out the e-mail? What if the address is ot ok? What if...? Must the requesting application know about this?
Lots of application/user-specific options raise their ugly heads.

Regards,
	Jorg Hohle.

---

From: Alexander Schreiber <[email-masked]>
Date: Thu Feb 12 09:32:05 2004

On Thu, Feb 12, 2004 at 02:44:37PM +0100, Hoehle, Joerg-Cyril wrote:
> OTOH, SMTP may not be what's needed, e.g. MS-Exchange could be used, or
> SSL transmissions. Also, the local mail may decide to store some mails
> locally. It makes some sense to delegate.

So run a local mail server speaking SMTP to local clients and taking
care of delivering mail, employing whatever means are appropriate
(be it SMTP, UUCP, printer-pigeon-scanner, ...) to deliver the mail
further.

SMTP _is_ a standard protocol for sending mail and even Exchange can be
configured to speak SMTP to the sane remainder of the world.

> My point here however is that, coming from an Amiga, I've often had a
> horror from code which IMHO gratuitously used UNIX (or MS-windows) 
> idioms where portable Lisp code could be used.
> 

Ok, ignoring the facilities of the programming environment one uses in
favour of running external commands is asking for punishment. Especially 
since running external commans usually adds a lot of unnecessary
problems (things like needing the sanitize the commandline, checking for
locations of executables, verifying execution and so on) and therefore
should be avoided as far as sensible just for this reason.

> Similarly, having used quite different UNIX systems like SunOS, Solaris2,
> some Linux and *BSD, code like the above tends to work on the author's
> system only, because of the many different command switches and 
> command paths.

That's an unfortunate problem when one deals with a wide variety of UNIX
platforms. Seems like commercial UNIX vendors really _did_ hate the
words portability and interoperability. Ways to deal with these problem
exist, but they aren't necessarily elegant.

> Lots of DEFVAR in every application is not the best way to configure
> a system that I can think of. My thoughts much more go towards sets
> of autonomous agents (let's call them that way), that now well how to
> perform a well-defined action, e.g. send out a single e-mail. Maybe 
> I'll see such systems put to broad use before the end.

So start working on it. Otherwise, the Java/XML crowd will get there
first and you'll end up with a few hundert megabytes worth of 
"Java Enterprise Modular Configuration Agent System" just to send a
simple email ;-)

> Reality is of course, more complex. What if the agent cannot send out
> the e-mail? What if the address is ot ok? What if...? Must the 
> requesting application know about this?

Regards,
       Alex.
PS: Could you please stick to keep your line length below 80 characters?
    Having to reformat an entire mail when quoting it sucks.
-- 
"Opportunity is missed by most people because it is dressed in overalls and
 looks like work."                                      -- Thomas A. Edison