*sigh*
Expected a nice intelligent discussion starting with 18 posts already.....instead found trolls and whiners.....that is enough BTT for one day (all 5 mins of it).
Yes - but you are welcome to help further the topic with something more interesting (am sorry that I seem to attract a lot of trolls these days).
Hey don't worry, I attract them just the same
We're doing similar Turing complete development here with eMunie and have had many a discussion of how to solve problems just as
while (1==1)
{ str += str; }
Our interpreters run a Java/JavaScript hybrid, the bulk of the script code being JavaScript, with calls possible into native Java functions depending on the permissions granted to that script by the executor.
Side stepping a lot of the technicalities, we investigated a number of ways to detect this behavior but couldn't come to a accepted method which allowed legitimate scripts to operate as intended, but malicious scripts to be detected (which was as we expected with a Turing complete implementation, but wanted to check it out anyway).
Ultimately we have decided on an implementation which doesn't attempt to combat it directly via outright detection, but allows the script itself to provide meta-data which indicates how much memory it is likely to use, average time between heartbeat signals the interpreter can expect and various other metrics. The creator of the script can execute a benchmarker which generates this meta-data, before deployment, and packages it into the script header.
With the parameters set, the executing nodes then have some information on expected behavior and requirements to execute. If the requirements are too great for that node, it can choose to not execute that script (Raspberry's for example), or pass it to the network for execution and receive a result, as similar to Hadoop Map-Reduce architecture. Additionally if the execution of that script exceeds the expectations, perhaps the script management module doesnt receive a heartbeat from that interpreter instance for a period of time beyond the expected average as per the meta data, that script can be terminated as each interpreter instance runs in its own sandboxed VM instance.
This kind of implementation should suffice, as the issuer of the script has to provide some information on what the script requires, if it exceeds those expectations by being malicious, then its very easy to detect and act accordingly.