4 ms·

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of i

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solution for this, and why doesn't Deno have more traction? I know one can do a lot more using outbound firewalls and selinux but after seeing how brilliantly Deno solves this I wonder why not every program lets me do this.

beebeepka 5y ago
I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog. Anyway, how does Deno solve this?
- eitland 5y ago
  I'll start with the question: Deno solves this by making you specify on the command line or in a config file what an application should have access to, for instance for a simple web application you can specify that it only has read acesss to one folder of static files, write access to the log folder and can only connect to the postgres server. It is also very simple, see: https://deno.land/manual@v1.16.4/getting_started/permissions https://deno.land/manual@v1.16.4/getting_started/permissions As for the first part, I'm in the lucky position where nobody can just rewrite everything to todays flavor of js, but where we can decide in the team to test out new technology when we have a chance to, for example on a new small project. There's another guy on the team that is enthusiastic about it too and I guess he'll throw together a demo soon, then we'll discuss it.
  - beebeepka 5y ago
    Thanks for your time. I am about to start a new personal project and your post, combined with some curiosity, is all I needed to hear. I've reached a point where doing the same thing with the same tech is making me feel uneasy.
    - eitland 5y ago
      Full disclosure: I've only toyed with it so far. That said: What I have seen seems extremely interesting, both the audited standard library and the permission model, the built in support for TypeScript, single binary runtime and the avoidance of a single package repo. Good luck with your next personal project. I guess now might be a perfect time to invest in learning Deno. It might not take of, but if it doesn't it will probably make me a little sad when I realize it, and I am a Java man (although I enjoy a number of other languages as well).
nl 5y ago
The JVM running with a security policy can do this. It's pretty rarely done though.
- _old_dude_ 5y ago
  The idea of having different declarative security realms is fine but it's not what the Java Security Manager is. The Java Security Manager is an API that allows to intercept and run codes, so devs use it as a Trojan Horse to patch code instead of fixing the root of the issue. The Java Security Manager should die.
  - vitus 5y ago
    Good news, it is going to die. https://openjdk.java.net/jeps/411 https://openjdk.java.net/jeps/411
  - nl 5y ago
    > The idea of having different declarative security realms is fine but it's not what the Java Security Manager is. But.. it is? The JVM tracks where bytecode was loaded from, and then you can define a policy to limit what that code can do. Here's an example giving read-only access to /etc https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html/how_to_configure_server_security/java_security_manager https://access.redhat.com/documentation/en-us/red_hat_jboss_...
- eitland 5y ago
  > It's pretty rarely done though. Exactly. That is why I like the Deno solution even as a long time Java user: it is on by default and so simple that there is no reason to disable it.

beebeepka 5y ago

I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog. Anyway, how does Deno solve this?

eitland 5y ago
I'll start with the question: Deno solves this by making you specify on the command line or in a config file what an application should have access to, for instance for a simple web application you can specify that it only has read acesss to one folder of static files, write access to the log folder and can only connect to the postgres server. It is also very simple, see: https://deno.land/manual@v1.16.4/getting_started/permissions https://deno.land/manual@v1.16.4/getting_started/permissions As for the first part, I'm in the lucky position where nobody can just rewrite everything to todays flavor of js, but where we can decide in the team to test out new technology when we have a chance to, for example on a new small project. There's another guy on the team that is enthusiastic about it too and I guess he'll throw together a demo soon, then we'll discuss it.
- beebeepka 5y ago
  Thanks for your time. I am about to start a new personal project and your post, combined with some curiosity, is all I needed to hear. I've reached a point where doing the same thing with the same tech is making me feel uneasy.
  - eitland 5y ago
    Full disclosure: I've only toyed with it so far. That said: What I have seen seems extremely interesting, both the audited standard library and the permission model, the built in support for TypeScript, single binary runtime and the avoidance of a single package repo. Good luck with your next personal project. I guess now might be a perfect time to invest in learning Deno. It might not take of, but if it doesn't it will probably make me a little sad when I realize it, and I am a Java man (although I enjoy a number of other languages as well).

nl 5y ago

The JVM running with a security policy can do this. It's pretty rarely done though.

_old_dude_ 5y ago
The idea of having different declarative security realms is fine but it's not what the Java Security Manager is. The Java Security Manager is an API that allows to intercept and run codes, so devs use it as a Trojan Horse to patch code instead of fixing the root of the issue. The Java Security Manager should die.
- vitus 5y ago
  Good news, it is going to die. https://openjdk.java.net/jeps/411 https://openjdk.java.net/jeps/411
- nl 5y ago
  > The idea of having different declarative security realms is fine but it's not what the Java Security Manager is. But.. it is? The JVM tracks where bytecode was loaded from, and then you can define a policy to limit what that code can do. Here's an example giving read-only access to /etc https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html/how_to_configure_server_security/java_security_manager https://access.redhat.com/documentation/en-us/red_hat_jboss_...
eitland 5y ago
> It's pretty rarely done though. Exactly. That is why I like the Deno solution even as a long time Java user: it is on by default and so simple that there is no reason to disable it.