4 ms·
Deno gives all packages the same permissions of the main app. So if your app can make network requests, so can every dependency you use. It’s not a great situat
by jakear 6y ago
Deno gives all packages the same permissions of the main app. So if your app can make network requests, so can every dependency you use. It’s not a great situation. I’ve brought this up to them and their response is that per-package permissions would be too difficult to implement.
- vijaybritto 6y agoYes, checking everyone at the main door is indeed easier than checking everyone at every single point of contact. It needs a vast architectural change compared to current implementation as you need to enforce those rules at runtime!
- jakear 6y agoWell yeah, but I thought the whole point of deno was to make vast architectural changes to allow for increased security. Seems odd to stop half way.
- Already__Taken 6y agoThe app design is going to have to change around per-process permissions. build.ts doesn't need the same as main.ts but at that point what are you getting where you couldn't just use docker and abstract that pattern to literally all software and dependencies that aren't in deno. Maybe it's a start of better tooling? Kicking out a graph of package/permission call stack might be useful to audit