5 ms·

No Sandbox – Applications That Run Chromium Without the Sandbox

32 points by simonpure 6y ago

wbkang 6y ago
Wait.. why is it significant that vscode has the sandbox disabled? Isn't executing (curated) arbitrary code part of its core functionality as an IDE? I am thinking extensions and ability to define tasks including arbitrary commands and so on.
yetanother-1 6y ago
How bad is it for programs like vscode, that is used by a lot of developers?
- my123 6y ago
  A VSCode extension can just run code in a host context anyway. It doesn't really matter there.
unsignedint 6y ago
Thing is that whole point of the local applications as opposed to running it off from a browser, is that it can do things sandbox would prevent, like in case for VSCode. Though, I guess it is beneficial if it is sandboxes where any of those "special" access is not needed, but then if that's the case, it just as well can be a applications that runs off from the browser or PWA...
mkj 6y ago
Signal and Discord seem pretty high risk programs there, handling network input from strangers.
zx2c4 6y ago
Response from Signal Desktop developer on an insufficient Signal PR I posted a while ago: https://github.com/signalapp/Signal-Desktop/pull/4381 https://github.com/signalapp/Signal-Desktop/pull/4381
- IshKebab 6y ago
  Unconvincing responses from them. I suspect the real reason is the one that they sort of mentioned - it's a ton of work to rearchitect an electron app that uses insecure APIs in the renderer to use to IPC instead. People really don't like saying "that's too much work". They trump up technical reasons instead.
sp1rit 6y ago
Something to note here is, that you can get the "source" from most of the non-free electron app by extracting the asar file. Makes it probably even easier to find bugs in them.
franga2000 6y ago
Is there not a switch that you can flip in electron saying "only run JS code from external files where URL origin == app archive"? Limiting external web requests to only your own domains would also fix this for the "basically Mozilla Prism" class of electron apps. That seems like it would make XSS basically impossible for these apps and surely easier to adapt to than a full sandbox. Pretty much the only attack vector left then is exploiting various media/data formats to gain proper RCE - but how is that any different than a usual desktop app?

32 points by simonpure 6y ago

Wait.. why is it significant that vscode has the sandbox disabled? Isn't executing (curated) arbitrary code part of its core functionality as an IDE? I am thinking extensions and ability to define tasks including arbitrary commands and so on.

yetanother-1 6y ago

How bad is it for programs like vscode, that is used by a lot of developers?

my123 6y ago
A VSCode extension can just run code in a host context anyway. It doesn't really matter there.

unsignedint 6y ago

Thing is that whole point of the local applications as opposed to running it off from a browser, is that it can do things sandbox would prevent, like in case for VSCode. Though, I guess it is beneficial if it is sandboxes where any of those "special" access is not needed, but then if that's the case, it just as well can be a applications that runs off from the browser or PWA...

mkj 6y ago

Signal and Discord seem pretty high risk programs there, handling network input from strangers.

zx2c4 6y ago

Response from Signal Desktop developer on an insufficient Signal PR I posted a while ago: https://github.com/signalapp/Signal-Desktop/pull/4381 https://github.com/signalapp/Signal-Desktop/pull/4381

IshKebab 6y ago
Unconvincing responses from them. I suspect the real reason is the one that they sort of mentioned - it's a ton of work to rearchitect an electron app that uses insecure APIs in the renderer to use to IPC instead. People really don't like saying "that's too much work". They trump up technical reasons instead.

sp1rit 6y ago

Something to note here is, that you can get the "source" from most of the non-free electron app by extracting the asar file. Makes it probably even easier to find bugs in them.

franga2000 6y ago

Is there not a switch that you can flip in electron saying "only run JS code from external files where URL origin == app archive"? Limiting external web requests to only your own domains would also fix this for the "basically Mozilla Prism" class of electron apps. That seems like it would make XSS basically impossible for these apps and surely easier to adapt to than a full sandbox. Pretty much the only attack vector left then is exploiting various media/data formats to gain proper RCE - but how is that any different than a usual desktop app?