3 ms·
>that sandboxes and limited API surfaces actually work While this is not a bad start, assuming they work is a bad option from a security standpoint. You shoul
by tscs37 10y ago
>that sandboxes and limited API surfaces actually work
While this is not a bad start, assuming they work is a bad option from a security standpoint.
You should be pessimistic and always assume the sandbox will be broken and the API abused. Then you plan for that.
Assuming nobody will ever hack your product because it's perfect is harmful for any security product. Period.
- alkonaut 10y agoSure. But we are talking about a system that already is in a sandbox, and that already has a limited API surface. If that doesn't work then we are all screwed anyway. I don't see it as a reason for not pursuing the idea of further shrinking the sandbox. A smaller language and smaller sandbox should theoretically be easier to validate than large langage running in a large sandbox.