Re: lexbind: how to replace lexical-let approach to hide secrets

[Daniel Colascione <dan.colascione@gmail.com>]

On 3/30/2011 2:56 PM, David Kastrup wrote:
> Stefan Monnier<monnier@iro.umontreal.ca>  writes:
>
>> When lexical-binding is set:
>>
>>   (let ((data "my secret"))
>>     (lambda () data))
>>
>> returns something like (closure ((data . "my secret") t) () data).
>> If you wan to hide the value, then use:
>>
>>    (let ((data (let ((sym (make-symbol "foo")))
>>                  (set sym "secret")
>>                  sym)))
>>      (lambda () (symbol-value data)))
>>
>> which is similar to the what lexical-let ends up doing.
>
> All of which, by necessity, contain the necessary material to get at the
> secret in the bytecode/closure/funcell.  Where, of course, it is
> reasonable easy to retrieve it.  And that is actually overkill, since
> you can always just call that closure.
>
> Anybody care to tell me what the point of this exercise is actually
> supposed to be?

The idea is to prevent secrets being accidentally revealed in 
backtraces, lisp evaluation results, and so on.

By the way: I didn't notice any secret erasure code in auth-source.el. 
Shouldn't someone somewhere do something like this?  I didn't see 
anything in alloc.c that looks like it'd clear an object's bytes upon 
deallocation.

(defun secure-erase-secret (my-secret)
   (dotimes (i (length my-secret)) (setf (aref my-secret i) 0)))