3 ms·
Not really. An effective sandbox is restrictive. Managed languages tend to use a more limited set of system calls than non-managed languages because most librar
by loosescrews 10y ago
Not really. An effective sandbox is restrictive. Managed languages tend to use a more limited set of system calls than non-managed languages because most libraries don't make any system calls of their own. The Go runtime and standard library use a more limited set of system calls than most alternatives, so a more limited set of sandbox filters are required.
Injected instructions are more likely to invoke their own system calls, so you are more likely to catch it if you have a more restrictive set of filters.
- Someone 10y ago"Managed languages tend to use a more limited set of system calls than non-managed languages because most libraries don't make any system calls of their own" I have a hard time understanding how that could be true. A library either needs to use OS functionality, or it doesn't. If it needs to, managed languages cannot avoid doing so, and if it doesn't, why would non-managed languages make them, more so since a major argument for the most popular of them, C, is performance? The only argument I can see is that managed language libraries could use (fewer) other libraries or the runtime to make such calls. Neither decreases the number of system calls made by any program.