4 ms·
It's a step in a positive direction that Deno makes you explicitly grant a script permission to do some things, but that's not at all what is meant by capabilit
by Sophistifunk 4y ago
It's a step in a positive direction that Deno makes you explicitly grant a script permission to do some things, but that's not at all what is meant by capabilities, and that's absolutely the wrong word to use to describe it. A capability is a first-class concept that exists at runtime, and is a value you must pass to dependencies that need it. You should also be able to use it to create new, dependent capabilities with fewer rights, and they should in general be much finer-grained than "can access the internet" to be of real use.
- schemescape 4y ago> they should in general be much finer-grained than "can access the internet" Just for the record, Deno does allow finer grained control than that: > --allow-net=<allow-net> Allow network access. You can specify an optional, comma-separated list of IP addresses or hostnames (optionally with ports) to provide an allow-list of allowed network addresses. https://deno.land/manual@v1.30.3/basics/permissions https://deno.land/manual@v1.30.3/basics/permissions
- continuational 4y agoAgreed - the Deno model doesn't bring much security, because you have to grant all code in the whole app the same permissions, which for any non-trivial app will amount to "mostly everything". First class capabilities are a much better approach, a real solution to supply chain attacks.
- vorticalbox 4y agoSure but things like web access you can grant access to just the domains your app uses and everything else is blocked same for file access you can grant is access to "views". Though most people will likely just --allow-all because it is easy.
- hayd 4y agoFor now. Realms will address this.
- matklad 4y agoThanks, it was confused thinking on my part, corrected!