3 ms·
Sigh. On the one hand, this seems like a slight improvement. On the other hand, while it’s a bit of a slog, it’s possible to actually sandbox dependencies. li
by amluto 3y ago
Sigh.
On the one hand, this seems like a slight improvement.
On the other hand, while it’s a bit of a slog, it’s possible to actually sandbox dependencies. libxz, for example, has well defined inputs and outputs. It’s possible to load it in such a way that all it can do is consume inputs and produce outputs that depend on those inputs. (And allocate memory and waste CPU, but that’s DoS at worst.)
- 10000truths 3y agoA shared object that is loaded in the same thread/process as the rest of your application is not sandboxed from your application.
- amluto 3y agoThat's true. But both in-process and out-of-process sandboxing are doable, as is writing code in a manner that is provably (for various definitions of provability) free of various classes of side effects.
- ptx 3y agoIn can be with RLBox[0], which compiles the code to WebAssembly and then back to C. It's used in Firefox to sandbox various format parsing libraries. [0] https://rlbox.dev/ https://rlbox.dev/