4 ms·

Will there be any PHP support?

christefano 19y ago
If there were it would mean the end of codepad.org. Think of the security implications of allowing anyone to run PHP on their server.
- davidw 19y ago
  Afaik, the only (reasonably common) languages with good sandboxes are Tcl and Java. Like they said above, they're the ones building the sandbox, not the language.
  - immad 19y ago
    You can map down a few languages to JVM executable bytecode, can't you?
  - LogicHoleFlaw 19y ago
    Lua has excellent support for building sandboxes for untrusted user code.
    - davidw 19y ago
      Interesting - but what do you mean 'building' sandboxes?
      - tokipin 19y ago
        i'm not exactly sure what he's talking about, but there's 2 things Lua has here. one is that the language is functional, so you can replace, alter, or remove the dangerous functions. the other is that you can specify the variable 'environment' of a function with a table (Lua's hash.) so you can construct its environment in an 'opt-in' basis and know for sure everything you're allowing the function to do is safe. and of course these things would be meaningless if built-in functions didn't behave like user functions
        jamongkad 19y ago
        Upmodded and done for Lua.
  - aaroniba 19y ago
    In what way does Java provide sandboxing of untrusted code?
    - wallflower 19y ago
      Untrusted Java web start applications and Java applets can't do anything that could harm the real operating system. We had to buy and keep on renewing an expensive code-signing cert so our app could save a local file. Every once in a while, a security researcher claims to have gotten untrusted bytecode to run outside the boundaries of the sandbox.
- rcoder 19y ago
  Think of the security implications of allowing anyone to run any language on their server. It doesn't matter if it's PHP, Ruby, or C++, since they all allow shell and filesystem access, unbounded recursion, and all the other goodies that make sandboxing interesting. The trick would be to run PHP as a command-line scripting language, just like the others.
- tlrobinson 19y ago
  I would be more worried about C... which this already runs (apparently securely)
- jamongkad 19y ago
  Oh just quit it. You and I both know that PHP can be made to run safely in this type of environment.
jamongkad 19y ago
Here here! why isn't there any PHP support?
- sah 19y ago
  PHP is one of the most requested languages. Support is on the way, probably sometime in the next couple weeks.

If there were it would mean the end of codepad.org. Think of the security implications of allowing anyone to run PHP on their server.

davidw 19y ago
Afaik, the only (reasonably common) languages with good sandboxes are Tcl and Java. Like they said above, they're the ones building the sandbox, not the language.
- immad 19y ago
  You can map down a few languages to JVM executable bytecode, can't you?
- LogicHoleFlaw 19y ago
  Lua has excellent support for building sandboxes for untrusted user code.
  - davidw 19y ago
    Interesting - but what do you mean 'building' sandboxes?
    - tokipin 19y ago
      i'm not exactly sure what he's talking about, but there's 2 things Lua has here. one is that the language is functional, so you can replace, alter, or remove the dangerous functions. the other is that you can specify the variable 'environment' of a function with a table (Lua's hash.) so you can construct its environment in an 'opt-in' basis and know for sure everything you're allowing the function to do is safe. and of course these things would be meaningless if built-in functions didn't behave like user functions
      - jamongkad 19y ago
        Upmodded and done for Lua.
- aaroniba 19y ago
  In what way does Java provide sandboxing of untrusted code?
  - wallflower 19y ago
    Untrusted Java web start applications and Java applets can't do anything that could harm the real operating system. We had to buy and keep on renewing an expensive code-signing cert so our app could save a local file. Every once in a while, a security researcher claims to have gotten untrusted bytecode to run outside the boundaries of the sandbox.
rcoder 19y ago
Think of the security implications of allowing anyone to run any language on their server. It doesn't matter if it's PHP, Ruby, or C++, since they all allow shell and filesystem access, unbounded recursion, and all the other goodies that make sandboxing interesting. The trick would be to run PHP as a command-line scripting language, just like the others.
tlrobinson 19y ago
I would be more worried about C... which this already runs (apparently securely)
jamongkad 19y ago
Oh just quit it. You and I both know that PHP can be made to run safely in this type of environment.

jamongkad 19y ago

Here here! why isn't there any PHP support?

sah 19y ago
PHP is one of the most requested languages. Support is on the way, probably sometime in the next couple weeks.