3 ms·
No, the point is that vulnerabilities in MRuby (the scope of this bug bounty) are now less impactful for them. They are still paying for them even if you don't
by FiloSottile 10y ago
No, the point is that vulnerabilities in MRuby (the scope of this bug bounty) are now less impactful for them.
They are still paying for them even if you don't have a sandbox escape, but less because it's. Ow less critical for their security.
- inopinatus 10y agoYes, I got the impression they'd been trying to build & secure a shared-process sandbox for customer-supplied logic, and have now given up on that and (wisely IMO) moved to a separate process model. Last time I needed to do something like this, I just asked people to give me an AWS Lambda endpoint to talk to. "You want your custom logic, fine, run it in a container you're responsible for."