3 ms·

If you're writing server stuff, at the coarse-grained level of isolation that Deno provides you're better off using just about anything else and restricting acc

• crabmusket 1y ago
  Deno can restrict access to filesystem files or directories, and to particular network domains, see docs for examples. https://docs.deno.com/runtime/fundamentals/security/#file-system-access https://docs.deno.com/runtime/fundamentals/security/#file-sy... However in general I don't think Deno's permission system is all that amazing, and I am annoyed that people call it "capability-based" sometimes (I don't know if this came from the Deno team ever or just misinformed third parties). I do like that "deno run https://example.com/arbitrary.js https://example.com/arbitrary.js" has a minimum level of security by default, and I can e.g. restrict it to read and write my current working dir. It's just less helpful for combining components of varying trust levels into a single application.
  • bugtodiffer 1y ago
    Yes it says it can do it, but it has been broken many times because it is shit
• vorticalbox 1y ago
  > Unlike Deno, it can restrict access to specific filesystem paths and network addresses deno can do this via --(allow/deny)-read and --(allow/deny)-write for the file system. You can do the same for net too https://docs.deno.com/runtime/fundamentals/security/#permissions https://docs.deno.com/runtime/fundamentals/security/#permiss...
• mk12 1y ago
  Bubblewrap is another convenient sandboxing tool for Linux: https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap