3 ms·

If your language is capable of expressing "this part of the code can't access the network", in a general way such that networking is not some special snowflake

If your language is capable of expressing "this part of the code can't access the network", in a general way such that networking is not some special snowflake that's baked in, then you've created an effects system which is likely to be useful in many, many other contexts for other things you want to assert without having them supported in the OS. (For example, "is this code async", or "does this code print anything", or "does this code have any side effects", or "does this code throw", or "does this code allocate".)

MattPalmer1086 5y ago
That's an interesting idea. Although denying network to log4j wouldn't have stopped this I think, as it was the JNDI code that made the network calls, not log4j directly.
- creatonez 5y ago
  Depends how capabilities work in the system. A restriction could prevent something from occurring at all in a bit of code, even in outside calls.
- nicoburns 5y ago
  You might be able to be more specific and only allow network connections to whitelisted addresses or similar.