4 ms·
If the property of "io-lessness" becomes something statically verifiable as part of dependency handling, it also seems potentially beneficial as a guard against
by atq2119 3y ago
If the property of "io-lessness" becomes something statically verifiable as part of dependency handling, it also seems potentially beneficial as a guard against supply-chain attacks.
- GrayShade 3y agoA compromised IO-less file system library can still synthetize malware files on a volume.
- atq2119 3y ago... but only on the volume it is explicitly given access to. So, if the library was IO-less (and didn't use unsafe code), you could embed it in some tool, e.g. for forensics, and not have to worry about it compromising the security of the "host" system.