4 ms·
I have always followed CouchDB from a distance, so I am curious, has anyone been able to pull the same crap writing Erlang or Javascript? This is more relevant
by 616c 11y ago
I have always followed CouchDB from a distance, so I am curious, has anyone been able to pull the same crap writing Erlang or Javascript? This is more relevant to the latter bc of the sandbox, but this NoSQL architecture decision sounds very familiar.
I swore I read something about attempting to break the JS sandbox but found nothing with my weak Googlefu.
- nemothekid 11y agoJS is a sandboxed language from the start, as it was originally designed to run in browsers. As we know from years of Java Applet-based exploits, it seems anything that allows you to run arbitrary code inside the JVM is just asking for exploits.
- MichaelGG 11y agoSo there's plenty of bugs in the JS interpreters, and you can use those to do regular exploits and run arbitrary code. Separately is escaping the sandbox due to a bug in the verification. JS is probably far easier to secure, since all the APIs are "safe" to call. That is, there isn't a huge JS stdlib that needs to be restricted. Like brainfuck-there's no way to make dangerous calls. Whereas Java has a huge stdlib that's accessible, so you're fighting an uphill battle to lock it down.