3 ms·

We need programming languages where every imported module is in its own sandbox by default.

by amelius 8mo ago

jFriedensreich 8mo ago
We have one where thats possible: workerd (apache 2.0) no new language needed just a new runtime
- amelius 8mo ago
  I mean, the sandboxing aspect of a language is just one thing. We should have sandboxing in Rust, Python, and every language in between.
jerf 8mo ago
Now is probably a pretty good time to start a capabilities-based language if someone is able to do that. I wish I had the time.
saidnooneever 8mo ago
just sandbox the interpreter (in this case), package manager and binaries. u can run in chroot jail and it wouldnt have accessed ssh keys outside of the jail... theres many more similar technologies aleady existing, for decades. doing it on a per language basis is not ideal. any new language would have to reinvent the wheel. better to do it at system level. with the already existing tooling. openbsd has plege/unveil, linux chroot, namespaces, cgroups, freebsd capsicum or w/e. theres many of these things. (i am not sure how well they play within these scenarios, but just triggering on the sandboxing comment. theres plenty of ways to do it as far as i can tell...)
- amelius 8mo ago
  What if I wanted to write a program that uses untrusted libraries, but also does some very security sensitive stuff? You are probably going to suggest splitting the program into microservices. But that has a lot of problems and makes things slow. The problem is that programs can be entire systems, so "doing it at the system level" still means that you'd have to build boundaries inside a program.
  - saidnooneever 8mo ago
    you can do multi process things. or drop privs when using untrusted things. you can use OS apis to isolate the thing u want to use just fine.. and yes, if you mix privilege levels in a program by design then u will have to design your program for that. this is simple logic. a programming language can not decide for you who and what you trust.
    - amelius 8mo ago
      > you can use OS apis to isolate the thing u want to use just fine.. For the sake of the argument, what if I wanted to isolate numpy from scipy? Would you run numpy in a separate process from scipy? How would you share data between them? Yes, you __can__ do all of that without programming language support. However, language support can make it much easier.
mike_hearn 8mo ago
Java had that from v1.2 in the 1990s. It got pulled out because nobody used it. The problem of how to make this usable by developers is very hard, although maybe LLMs change the equation.
staticassertion 8mo ago
In frontend-land you can sort of do this by loading dependencies in iframe sandboxes. In backend, ur fucked.
sph 8mo ago
https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Object-capability_model https://en.wikipedia.org/wiki/Object-capability_model
codethief 8mo ago
Or just make side effects explicit in the type system through monads or algebraic effects.

We need programming languages where every imported module is in its own sandbox by default.

by amelius 8mo ago

We need programming languages where every imported module is in its own sandbox by default.

jFriedensreich 8mo ago

We have one where thats possible: workerd (apache 2.0) no new language needed just a new runtime

amelius 8mo ago
I mean, the sandboxing aspect of a language is just one thing. We should have sandboxing in Rust, Python, and every language in between.

jerf 8mo ago

Now is probably a pretty good time to start a capabilities-based language if someone is able to do that. I wish I had the time.

saidnooneever 8mo ago

just sandbox the interpreter (in this case), package manager and binaries. u can run in chroot jail and it wouldnt have accessed ssh keys outside of the jail... theres many more similar technologies aleady existing, for decades. doing it on a per language basis is not ideal. any new language would have to reinvent the wheel. better to do it at system level. with the already existing tooling. openbsd has plege/unveil, linux chroot, namespaces, cgroups, freebsd capsicum or w/e. theres many of these things. (i am not sure how well they play within these scenarios, but just triggering on the sandboxing comment. theres plenty of ways to do it as far as i can tell...)

amelius 8mo ago
What if I wanted to write a program that uses untrusted libraries, but also does some very security sensitive stuff? You are probably going to suggest splitting the program into microservices. But that has a lot of problems and makes things slow. The problem is that programs can be entire systems, so "doing it at the system level" still means that you'd have to build boundaries inside a program.
- saidnooneever 8mo ago
  you can do multi process things. or drop privs when using untrusted things. you can use OS apis to isolate the thing u want to use just fine.. and yes, if you mix privilege levels in a program by design then u will have to design your program for that. this is simple logic. a programming language can not decide for you who and what you trust.
  - amelius 8mo ago
    > you can use OS apis to isolate the thing u want to use just fine.. For the sake of the argument, what if I wanted to isolate numpy from scipy? Would you run numpy in a separate process from scipy? How would you share data between them? Yes, you __can__ do all of that without programming language support. However, language support can make it much easier.

mike_hearn 8mo ago

Java had that from v1.2 in the 1990s. It got pulled out because nobody used it. The problem of how to make this usable by developers is very hard, although maybe LLMs change the equation.

staticassertion 8mo ago

In frontend-land you can sort of do this by loading dependencies in iframe sandboxes. In backend, ur fucked.

sph 8mo ago

https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Object-capability_model https://en.wikipedia.org/wiki/Object-capability_model

codethief 8mo ago

Or just make side effects explicit in the type system through monads or algebraic effects.