> “They’re not really thinking about defending against these kinds of attacks.” What should we do then? I am not familiar with bitcoin so I can't say exactly

> “They’re not really thinking about defending against these kinds of attacks.” What should we do then? I am not familiar with bitcoin so I can't say exactly how to defend it other than just say block certain tools at least. Any site providing service to run user code is always vulnerable to code execution abuse, and this is where sandbox and strict job execution policy (job timeout, system call prohibitions, whitelist approach etc) are required. But that will degrade the service's usefulness. Obviously reading /etc/passwd should return permission denied or at least returns nothing and any file creation is restricted to local sandbox. I'd like to ask people from codeacademy and coursera to reveal a bit more about their security policy. You can build your own rainbow table if they allow you to use the hash library, http request and sends request to remote service (with a digitalocean account you can pay $5 for 20GB SSD storage).