3 ms·
Sandboxing seems like the obvious solution. These tools prompt me to review an absurd number of very complex bash commands where there is realistically no way t
by SchemaLoad 2mo ago
Sandboxing seems like the obvious solution. These tools prompt me to review an absurd number of very complex bash commands where there is realistically no way to carefully review them. I just want to put the thing in a box with the code and let it run any number of commands on the code without prompting.
- eru 2mo agoYou can actually use a hook to have a script review the (bash) commands for you.
- SchemaLoad 2mo agoThis is still less safe and less convenient than sandboxing. I want them to be able to run whatever command they want inside the sandbox even if it's traditionally dangerous (overwrites files, etc) because it can't touch anything that matters and I can revert any changes to the code myself. If anything the only thing you'd have to have reviewed is sandbox escape attempts.
- eru 2mo agoYou are right. And the hook is for convenience, not for safety. Having explicit sandboxes is good, of course. But in addition I also treat my whole computer like a sandbox, it least in the sense that there's no files I would mind if they were overwritten or deleted: you should have backups anyway.