4 ms·
Where are they running the code? I could easily write malicious code that would crash the machine on which the code would be running on.
by TeeWEE 12y ago
Where are they running the code? I could easily write malicious code that would crash the machine on which the code would be running on.
- nkozyra 12y agoI may be wrong here but to address a comment above, my hunch is this is spawning a light, short-lived VM for this, which doesn't eliminate security concerns but would be sandboxed enough to make it tougher. I was trying to get some info on environment in C++ but unfortunately, > Oh no, there's a problem with Runnable!
- nkozyra 12y agoActually, after playing around the system doesn't seem to be ephemeral, so hopefully something along the lines of Docker as mentioned below.
- TheHydroImpulse 12y agoYep, there's playpen[0] that's ultimately used as a security sandboxing. This is what's used on the new Rust playpen area: http://playtest.rust-lang.org/ http://playtest.rust-lang.org/ (Not fully ready, still needs some beautifying -- that's why it's on playtest and not the play subdomain). [0]: https://github.com/thestinger/playpen https://github.com/thestinger/playpen
- Intermernet 12y agoMy guess, something like Docker. It only matters if you can break out of the Linux container.
- stevekemp 12y agoIt used to be trivial to break out of docker containers, if you had root within them. I suspect that is still the case.
- tlunter 12y agoIs this serious or just some spreading some FUD? Can you show me an example? Honest question
- general_failure 12y agoFUD
- stevekemp 12y agoExample here: http://blog.bofh.it/debian/id_413 http://blog.bofh.it/debian/id_413 * Got root in the countainer. * You "know" where that is mapped to on the host, because it is based on the UID of the container which is set as the hostname. * You configure a trigger to run a script, using that knowledge. * Code happens on the host, outside the container.
- general_failure 12y agoThe above example is about LXC and sysfs. We are talking docker which uses aufs.
- stevekemp 12y agoIndeed, this is an LXC attack, rather than docker-specific. But, that said, the attack works as specified against docker 0.11.0. Largely because guests do have sysfs mounted at /sys.
- stevekemp 12y agoPlease see this example - http://blog.bofh.it/debian/id_413 http://blog.bofh.it/debian/id_413
- deleted 12y ago[deleted]
- jarrett 12y agoEven if the code is sandboxed, it's possible to run outgoing attacks from something like this. The same is of course true of traditional server rentals, EC2, and any other service that gives you an OS instance of your own. The difference, though, is those are (ostensibly) less anonymous.
- ceoj 12y agoThey may have sandboxed it, using something like lxc-containers.
- toddkaufmann 12y agotranspile it all into js and run in node! (I know this may be limiting for some features/libraries, but only a matter of time.) See https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death... on taking this to an "extreme" -- linux, Gimp on X windows, even Chrome -- transpiled and running in a firefox tab.
- mVChr 12y agoWhy crash the machine when you can use it? Let's say someone wanted to run a ton of background processes to make a ton of requests to some server for whatever reason.