3 ms·

Achieving supply-chain security by controlling every link in the chain. This Jon is very noble.

• jbverschoor 3y ago
  Packages should specify their entitlements.. network access, file access, executing system calls, being able to monkey patch things, accessing packages outside their own.
  • vorticalbox 3y ago
    Deno has a few of these by default an application has no access to the filesystem, env or network. You can allow only reading or only writing for files and you can also define what domains are allowed.
    • jbverschoor 3y ago
      Sure it's a huge step forward. But that's on an application level, which honestly I can do with sandbox-exec on macOS (see below). In Deno, all permissions would still propagate down to the dependencies. (version 1) (deny default) (allow file-read* (subpath "~/Downloads") ) (allow network-outbound (remote tcp "localhost:80") ) or (version 1) (allow default) (deny network*) or # start an airgapped shell, and play around in there.. sandbox-exec -p "(version 1)(allow default)(deny network*)" bash
      • vorticalbox 3y ago
        There have been a few GitHub issues open but from what I can tell it's in the "not technically possible with V8 VM" category
• smolder 3y ago
  Realistically I think they long ago should have been banned from npm, with all submissions deleted.