4 ms·
This is actually a vulnerability in any language that provides a networked REPL. I'm glad that Guile kept the option to run a REPL via a port, because that's r
by qwertyuiop924 10y ago
This is actually a vulnerability in any language that provides a networked REPL.
I'm glad that Guile kept the option to run a REPL via a port, because that's really useful for debugging nonlocal servers (investigating production issues, etc.).
- paroneayea 10y agoIt does look like there's a way to "forward" a unix domain socket over ssh enough to do that kind of debugging: https://debian-administration.org/users/dkg/weblog/68 https://debian-administration.org/users/dkg/weblog/68
- qwertyuiop924 10y agoThat's certainly a potential solution.
- fulafel 10y agoNetworked REPL doesn't preclude security. See eg Twisted's SSH based twisted.conch.manhole
- qwertyuiop924 10y agoYeah, but until you linked that, I'd never seen a networked REPL that actually provided it.
- tetrep 10y agoWhy not have the REPL (or whatever else you're exposing to localhost) require a token for authentication of each request?
- qwertyuiop924 10y agoBecause it's usually a raw socket, not an HTTP interface, so that's kind of tricky. But it could work.