4 ms·

The most compelling argument for Deno is the permission system in my opinion. Node added a permission system recently, but it's much more coarse grained than De

The most compelling argument for Deno is the permission system in my opinion. Node added a permission system recently, but it's much more coarse grained than Deno's. Being able to limit a script to listening on a specific hostname and port, or only allowing it to read a specific environment variable is pretty cool, and makes me less paranoid about trusting third party dependencies. Both Bun and Deno are also more performant than Node in many cases, and add a bunch of little quality of life improvements.

int_19h 3y ago
The real question is how much you can trust this. Those kinds of permission systems have been tried before - e.g. .NET used to have something called "Code Access Security". It was retired largely because the very notion of VM-enforced sandbox was deemed inadequate from experience. IIRC SecurityManager in Java was something similar, also deprecated for similar reasons. I'm afraid that Deno will just be a repeat of that.
- throwitaway1123 3y ago
  I definitely wouldn't make the Deno sandbox my only line of defense — I'm a strong proponent of defense in depth. Now having said that, there's definitely a precedent for trusting V8's sandboxing capabilities. Cloudflare is running untrusted user code across their entire network and relying on V8 isolates as a sandboxing mechanism for Cloudflare Workers. I'm not sure I would go that far, but I do think we should be taking advantage of the strides browser developers have been making from a security perspective. When I re-watched Ryan Dahl's original conference talk where he introduced Deno, the sandboxing aspect was the part that resonated the most with me. But again, it's always best to have multiple layers of security. You should sandbox your applications and audit your dependencies, those mitigation techniques aren't mutually exclusive.
  - int_19h 3y ago
    .NET sandbox was used for ClickOnce and Silverlight for many years. Java's was used for applets even longer. It worked until it didn't. The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs.
    - throwitaway1123 3y ago
      > The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs. I can see why they chose that route. It's a huge maintenance burden. I can't imagine Google throwing in the towel when it comes to securing their browser's JS engine though.
      - int_19h 3y ago
        That's assuming that you can fit everything within the needs of the browser sandbox. But server-side JS needs are broader than that.
        throwitaway1123 3y ago
        It's much easier to worry about locking down the few server-side modules which allow access to the underlying OS, than it is to have to worry about securing V8's JIT compiler. Node's module-based permission system literally just bans certain standard library modules from being imported (Deno's is more fine grained thankfully). That's a much smaller attack surface area to worry about compared to securing the underlying JS engine.
        vmfunction 3y ago
        Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: #!/usr/bin/env -S deno run --allow-net Then one can just run ./test.ts if the script has +x permission. Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. It is a good idea to beware of the VC. So it is good idea to support project such as Hono (projects conform to modern web standard, and is runtime agnostic for JS).
- ptx 3y ago
  What do you think of WebAssembly modules? It looks to me like the shared memory support that came with the threading proposal (which seems somewhat widely supported) should allow libraries to be isolated in their own modules and exchange data through explicitly shared memory even if they run on the same thread. With secure isolation being a requirement for web browsers, and with the backing of multiple big companies, it seems like there should be enough momentum to make it work properly. Or maybe the browsers rely entirely on process isolation between different origins and won't care about the security of isolating individual modules?
  - int_19h 3y ago
    Wasm is better positioned for this in that, as a lower-level spec, the attack surface is inherently much smaller. But also in many ways it is essentially a VM, just for an architecture that has no dedicated hardware outside of VMs. Wasm shared memory semantics are very similar to process isolation on OSes, so presumably the same techniques can be used there (and if those techniques are faulty, then so are containers and VMs).
silverwind 3y ago
Imho those permission systems are still too rudimentary and too non-automated. Instead of CLI flags I would like to see permission enforced at dependency boundaries, e.g. import foo from 'foo' with {permissions: ['fs', 'net']}
- throwitaway1123 3y ago
  Enforcing permissions at dependency boundaries would be the ultimate goal, but trying to separate first-party code from third-party code within the same thread is a herculean task (if I pass a callback to a dependency, which permissions does it run with for example), and you can't really lean on JS engines to do the heavy lifting, because they weren't designed with that threat model in mind. The best you can do currently is run your dependencies in a Worker, and enforce permissions programmatically for the worker [1]: For example: new Worker(import.meta.resolve('./worker.js'), { type: 'module', deno: { permissions: { net: ['news.ycombinator.com'], read: [new URL('./sqlite.db', import.meta.url)], write: false, }, }, }) This isn't perfect by any means, and you shouldn't rely on it like a silver bullet, but if given the choice I'd rather have permissions in my security toolbox. [1] https://docs.deno.com/runtime/manual/runtime/workers#specifying-worker-permissions https://docs.deno.com/runtime/manual/runtime/workers#specify...

int_19h 3y ago

The real question is how much you can trust this. Those kinds of permission systems have been tried before - e.g. .NET used to have something called "Code Access Security". It was retired largely because the very notion of VM-enforced sandbox was deemed inadequate from experience. IIRC SecurityManager in Java was something similar, also deprecated for similar reasons. I'm afraid that Deno will just be a repeat of that.

throwitaway1123 3y ago
I definitely wouldn't make the Deno sandbox my only line of defense — I'm a strong proponent of defense in depth. Now having said that, there's definitely a precedent for trusting V8's sandboxing capabilities. Cloudflare is running untrusted user code across their entire network and relying on V8 isolates as a sandboxing mechanism for Cloudflare Workers. I'm not sure I would go that far, but I do think we should be taking advantage of the strides browser developers have been making from a security perspective. When I re-watched Ryan Dahl's original conference talk where he introduced Deno, the sandboxing aspect was the part that resonated the most with me. But again, it's always best to have multiple layers of security. You should sandbox your applications and audit your dependencies, those mitigation techniques aren't mutually exclusive.
- int_19h 3y ago
  .NET sandbox was used for ClickOnce and Silverlight for many years. Java's was used for applets even longer. It worked until it didn't. The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs.
  - throwitaway1123 3y ago
    > The people who designed those things ultimately threw in the towel and said that if you want that kind of security, use containers or VMs. I can see why they chose that route. It's a huge maintenance burden. I can't imagine Google throwing in the towel when it comes to securing their browser's JS engine though.
    - int_19h 3y ago
      That's assuming that you can fit everything within the needs of the browser sandbox. But server-side JS needs are broader than that.
      - throwitaway1123 3y ago
        It's much easier to worry about locking down the few server-side modules which allow access to the underlying OS, than it is to have to worry about securing V8's JIT compiler. Node's module-based permission system literally just bans certain standard library modules from being imported (Deno's is more fine grained thankfully). That's a much smaller attack surface area to worry about compared to securing the underlying JS engine.
        vmfunction 3y ago
        Also with Deno, it become very easy to write typed cli. .ts file can be run as script very easily with permission access defined on top of the script such as: #!/usr/bin/env -S deno run --allow-net Then one can just run ./test.ts if the script has +x permission. Also project such as https://cliffy.io https://cliffy.io has made writing cli way more enjoyable than node. It is a good idea to beware of the VC. So it is good idea to support project such as Hono (projects conform to modern web standard, and is runtime agnostic for JS).
ptx 3y ago
What do you think of WebAssembly modules? It looks to me like the shared memory support that came with the threading proposal (which seems somewhat widely supported) should allow libraries to be isolated in their own modules and exchange data through explicitly shared memory even if they run on the same thread. With secure isolation being a requirement for web browsers, and with the backing of multiple big companies, it seems like there should be enough momentum to make it work properly. Or maybe the browsers rely entirely on process isolation between different origins and won't care about the security of isolating individual modules?
- int_19h 3y ago
  Wasm is better positioned for this in that, as a lower-level spec, the attack surface is inherently much smaller. But also in many ways it is essentially a VM, just for an architecture that has no dedicated hardware outside of VMs. Wasm shared memory semantics are very similar to process isolation on OSes, so presumably the same techniques can be used there (and if those techniques are faulty, then so are containers and VMs).

silverwind 3y ago

Imho those permission systems are still too rudimentary and too non-automated. Instead of CLI flags I would like to see permission enforced at dependency boundaries, e.g. import foo from 'foo' with {permissions: ['fs', 'net']}

throwitaway1123 3y ago
Enforcing permissions at dependency boundaries would be the ultimate goal, but trying to separate first-party code from third-party code within the same thread is a herculean task (if I pass a callback to a dependency, which permissions does it run with for example), and you can't really lean on JS engines to do the heavy lifting, because they weren't designed with that threat model in mind. The best you can do currently is run your dependencies in a Worker, and enforce permissions programmatically for the worker [1]: For example: new Worker(import.meta.resolve('./worker.js'), { type: 'module', deno: { permissions: { net: ['news.ycombinator.com'], read: [new URL('./sqlite.db', import.meta.url)], write: false, }, }, }) This isn't perfect by any means, and you shouldn't rely on it like a silver bullet, but if given the choice I'd rather have permissions in my security toolbox. [1] https://docs.deno.com/runtime/manual/runtime/workers#specifying-worker-permissions https://docs.deno.com/runtime/manual/runtime/workers#specify...