5 ms·
F-Secure has open-sourced its Sandboxed Execution Environment
- orf 11y agoWoah, I was not expecting that. Not only is it in Python but it's nice Python, not the bastardized "I can write C, let's try Python" style you often see from big companies.
- wnevets 11y agoI don't write python but what makes it nice python?
- AnkhMorporkian 11y agoIt uses classes, magic methods where appropriate, is well documented, does its loops in a pythonic way; lots of things! It's taking advantage of idiomatic python, as opposed to simply using python as a C-style hammer.
- wlesieutre 11y agoI wasn't familiar with the "magic methods" term, so for anyone else in the same boat, that refers to the functions like __init__, __repr__, __add__, __hex__, __len__, etc that you can define in your classes to make them work with built in functions like len(custom_listy_thing) or arithmetic.
- orf 11y agoMore than just built in functions, any object that defines a __len__ and a __index__ method (that provide len(x) and x[0] respectively) can also be iterated over in a for loop ('for item in instance'). A good reference for magic methods is [1] for anyone interested. 1. http://www.rafekettler.com/magicmethods.html http://www.rafekettler.com/magicmethods.html
- paxcoder 11y agoAs a C programmer who "tried" Python, I feel offended. I wrote substantial OO code using list comperhensions and other things pythonic. I am also a functional programming affectionado, though a realist, not a fan. Don't label people. Speak against companies mismanaging people by driving them to write low quality code. Be open and promote useful programming concepts and tools. P.S. Long live static typing. Down with EcmaScript.
- orf 11y agoI'm sorry you feel offended but my comment was not labelling anyone, merely stating surprise that a company I did not know used Python produced a large, idiomatic Python project seemingly out of the blue. Similar projects at other companies might have produced huge OOP classes with LotsOfCamelCase, c-style for loops and other such constructs. Kudos to them and the author. > Speak against companies mismanaging people by driving them to write low quality code I don't think that's relevant to my comment, but I would say that it's not some company overlord making people churn out non-idomatic Python code.
- baq 11y agowhen you write C, you should be writing elegant C. when you write Python, you should be writing elegant Python. trying to code Python in C is about as ugly as trying to code C in Python and both should be discouraged equally. the thing i don't understand is what you took offense at.
- paxcoder 11y agoSwap the languages around and see if the statement doesn't sound a bit elitist to you. I feel like the parent could have chosen more neutral words if they wanted to. Their particular experience with irreverent/careless programmers just rubbed against my experience with technology fans I guess (the word fans used in the same sense as in my previous comment).
- scott_karana 11y agoSwapping the languages fits exactly consistently with what GP said. Trying to use first-class functions and OO paradigms in C is going to bite you in the ass, hard. Just as iterative pointer manipulations in Python aren't preferable. Both languages have different "styles" that suit their purposes excellently, but mixing them improperly in either direction will be painful.
- dr_zoidberg 11y agoThat style of Python (the C-oriented, shall we say?) is responsible for a lot of "Python is too slow" comments. I've seen code from big projects where string concatenation and manipulation was done one character at a time...
- gruez 11y agoSlightly off topic, but how well do sandbox execution environments handle malware that only execute if a VM is not detected? AFAIK most virtualization environments are easily detectable by the guest.
- peterwwillis 11y agoThe sandbox just provides environment separation to run automated tests independently. How you define the environment, and how malware may react to it, is up to the user. (However, the 'hooks' could in theory be written to circumvent or detect malware looking for signs of a guest VM)
- eugenekolo2 11y agoWhat are the advantages of using this over Cuckoo Sandbox, or Anubis?
- vill1 11y agoMaybe the biggest advantage is the plugin system and how those can be hooked to the execution. Developer focuses on writing a LEGO brick that can be used as a part of execution. Also different plugins do not need to care about existence of other plugins, but on the other hand those plugins can be chained by firing and listening to events.
- eugenekolo2 11y agoCuckoo supports plugins too, I wrote up a summary of them here: https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_custom https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_cu.... Can also edit the Analyzer/monitor part to add in new function hooks.
- noxdafox 11y agoCuckoo is a full-feature behaviour analysis platform which supports extensions via plugins. SEE is a modular and flexible framework for building sandboxed test automation against generic software. Focus of SEE design is to speed up the development of behavioural analysis platforms. It allows to choose between several different sandboxing technologies and provides a plugin-based event-driven architecture in order to control them. SEE is for developers and not for users. If you want an out-of-the-box solution for analysing malware you choose Cuckoo. If you want to develop your own analysis platform, you better try out SEE.
- blahsphemer 11y agowhy would they open source this?
- vill1 11y agoWhy not, this is just a general purpose framework for driving virtual machine execution? Hopefully someone will find this useful and write plugins and share those for the community as well.
- noxdafox 11y agoThe tool is shown in the video at the following link. https://www.youtube.com/watch?v=k185OMivqbQ&list=PLJ6grbbdTPW8gX-Nl_B_ijDvwu9WoO_rG&index=103 https://www.youtube.com/watch?v=k185OMivqbQ&list=PLJ6grbbdTP...