7 ms·
Scastie: use any Scala compiler and Scala library in the browser
- aghll0ihph2bbe8 9y agoHow am I supposed to dismiss this modal window? http://i.imgur.com/atx6KsX.png http://i.imgur.com/atx6KsX.png
- masgui 9y agohum this look like a but in safari https://github.com/scalacenter/scastie/issues/ https://github.com/scalacenter/scastie/issues/. You can visit this link: https://scastie.scala-lang.org/MasseGuillaume/kHn9lemPTayxoY20e09uiw https://scastie.scala-lang.org/MasseGuillaume/kHn9lemPTayxoY... and it will clear the modal.
- atemerev 9y agoHi Heather! Looks like you've got a Hacker News effect on your shoulders. :) Servers seem to be overloaded.
- atemerev 9y ago(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
- masgui 9y agoIt does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
- atemerev 9y agoI am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload). My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access is enabled). I think it is a good idea to at least disable networking. (Update: and use a minimal Docker image like Alpine Linux). Proof: [__REDACTED__]
- masgui 9y agoYeah disabling networking was an idea. I prefer to leave it open so you can try http client/libraries that access the web. To limit spam, if it becomes an issue we could throttle the connection.
- opportune 9y agoI agree with this. What's to stop me from opening a bunch of the containers and using them to DDOS someone or to send out spam emails? I'm already playing around with system commands and they seem to be entirely unrestricted. Basically I can run any bash script, as is, with import sys.process._ "BASH_COMMAND" !! And I seem to be able to at least cause the containers to endlessly restart quite simply.
- clhodapp 9y agoThe general rule is that you want as many layers of security as you can get away with without making things impractically inconvenient. In this case, the first step is probably not letting the user's code run as root in the container. Gaining container-root is going to be the first step in many, many exploits and by letting code just run that way, you are giving a potential attacker that step for free. Disclaimer: Absolutely not a security expert, just someone who is somewhat on the hook for security!
- monksy 9y ago/etc/shadow works as well :S But there are not encrypted bits in it.
- wiradikusuma 9y agoI'm a Scala developer but I don't understand what is Scastie. How does it benefit from the perspective of developers like me?
- richardwhiuk 9y agoIt's an interactive playground for Scala so you can share code and send it to other people. https://scastie.scala-lang.org/ https://scastie.scala-lang.org/
- mark_l_watson 9y agoThis looks cool, I just experimented with it. I am curious: what is the business model for this? Server costs are probably fairly expensive.
- masgui 9y agoWe are the [Scala Center](https://scala.epfl.ch https://scala.epfl.ch). We are a non-profit organization. Our revenue is from donations. This service will be forever free.
- drewda 9y agoSeems like the Scala and SBT equivalent of https://npm.runkit.com/ https://npm.runkit.com/ (which allows in-browser use of Node and NPM packages)
- freekh 9y agoThis looks so cool!!! Can't wait to try it out!
- hayd 9y agoWill this allow running a play app? (with debug etc) ??
- masgui 9y agoYes it can run anything sbt can. https://scastie.scala-lang.org/MasseGuillaume/62vmEr9XR0qDWwimrO3r2Q https://scastie.scala-lang.org/MasseGuillaume/62vmEr9XR0qDWw...
- stephen123 9y agoIts great to see so much good stuff going on in Scala land!