3 ms·
> basically fine How many type confusion 0 days and memory safety issues have we had in dynamic language engines again? I've really lost count.
by dcsommer 11mo ago
> basically fine
How many type confusion 0 days and memory safety issues have we had in dynamic language engines again? I've really lost count.
- gpm 11mo agoAre you counting ones that involve running malicious code in a sandbox and not just trusted code on untrusted input? Because then I'd agree, but that's a much harder and different problem. My impression is that for the trusted code untrusted input case it hasn't been that many, but I could be wrong.
- bigyabai 11mo agoIt depends, what language was the sandbox written in?
- gpm 11mo agoSandboxes are difficult independent of language, see all the recent speculation vulnerabilities for instance. Sure, worse languages make it even harder, but I think we're straying from the original topic of "python/ruby" by considering sandboxes at all.
- zahlman 11mo agoHow many ways to cause a segmentation fault in CPython, that don't start with deliberate corruption of the bytecode, are you aware of? How is "type confusion" a security issue?