I was a fan of deno because at least they tried, its not that there was an alternative runtime that tries to do permissions right or that there is an operating system tool that allows async(!) permissions with user interaction. We really need a simple to use "productised" but true open source solution that allows halting any software and evaluating policies for run, fs and network etc and can reason on process and context level.
If I’ve understood this correctly, you’re using “capability” to mean something kind of like what Linux means: there is a collection of capability types, and each type is a singleton. (And at least the beginning of your page does not clarify whether the distinction between “needs IO” and “Cap(IO)”.)
This is genuinely useful in a language, but I suspect it’s also pretty weak. Serious capability systems have capabilities that are instances of types, and two instances are not necessarily the same. For example, the capability to read one file is not the capability to read another file. Singletons may still exist: the capability to read the system clock could reasonably be a singleton. (Or not: one may reasonably debate whether the cycle counter and the realtime clock are instances of the same type or not, and you’ll find that mainstream languages have what amount to very different answers to this sort of question.)
You're better off relying on OS-level security mechanisms. Not only is it more likely to be much safer/secure, but it also means you don't have to worry about compatibility, missing features, etc. when you switch runtimes/software stacks.
> It does not provide security guarantees in the presence of malicious code. Malicious code can bypass the permission model and execute arbitrary code without the restrictions imposed by the permission model.
The permission model is more of a "help developers not accidentally "rm -rf /" their local machine than it is something that helps end users.
If you like having something for security — even in Node — check out something I invented, called SafeScript.
It’s for executing untrusted code written by others… a large subset of Javascript which guarantees the code can only call the Facades you inject, and you can hook and intercept anything. It works with callbacks and promises.
What’s more is that it runs in WebWorker sandboxes on the web, and uses a proxy to transparently make existing code make same method calls, or use existing objects, like window.document, but to safer versions, which only allow eg createElement.
And because SafeScript automatically awaits every async function, your synchronous calls to HTMLElement methods etc. will be proxied asynchronously and “just work” without changing the original JS code. SafeScript is robust enough that most existing JS components will simply work without changes when ported to SafeScript.
PS: It can also be embedded in PHP, so you can run untrusted handlers there, too, without worrying about PHP’s large security surface.
PPS: SafeScript is deterministic by default, so you can also get the same results across all environments or runs. You can set the random number generator seed yourself, or inject Date.now() as one of your APIs if you want.
I actually have a terminal program that needs to ask for sensitive inputs from the user sometimes, potentially after attacker data has been printed. I've been trying to figure out how I should handle that!
My plan was to encode to Unicode (lossily), strip out control characters, and add some visual framing. Anything else I should be considering? Is there a standard approach? Haven't actually done the research on this yet, but since it came up here, I figure someone might know.
Stripping out just the control characters isn’t enough. A lot of terminal control sequences start with a single control character followed by normal printable characters but such printable characters are part of the control sequence. And even when you strip out entire terminal control sequences there are still other Unicode characters that will play tricks. Examples include the Unicode right-to-left override, which is not an ASCII control character but a Unicode control character. There are also dozens of space characters that look like spaces but won’t be split by ASCII word splitting processing, etc.
Oh, it's not like a password (where you'd want to prevent echo). The value is actually a digest of a public key -- one instance of the program prints the digest, and the user has to enter it into the other instance of the program. This is for setting up a secure P2P connection.
I may have misstated the problem above. What I really need to ensure is that a malicious output can't say "the digest is abc123" and trick the user into pasting that into the other program (when the real digest is def456).
> the permission prompt is “partially visible” (you can see an emoji)
Terminals can be configured to render emoji in text presentation form where they become monochrome glyphs that can be colored like ordinary text with escape sequences. Not something to hinge your security model on.
It was a neat idea but they didn't take it far enough. It would have been neat if you could restrict dependencies from network/FS access, but they didn't make it that granular.
I was a fan of Deno from the beginning, but not targeting NodeJS compatibility at the beginning turned out to be the wrong move. Now Bun gets to be Anthropic's testbed for the future of software development. (Which includes the wholesale plagiarism and optimization of Oxc into its codebase, wowza.)
Side note: `deno fmt` is a great Markdown formatter. I might get around to extracting out just that part of it.
Deno is a dead man walking, they cashed out being useful to CF and other than that, they tried parity with nodejs, which was naive, I am not going to redo my backend just for that.
I'm not a fan of opinions in titles. (there I did it)
It is self-centered and narcissistic. Why? WTFRU. An opinion isn't an argument. You have to have reasons beyond your opinions and those are what matter. Lead with those, and your opinion is implied by the fact you are talking about it.
Deno's Security Model is a False Sense of Security
Deno's Permissions Are Not a Sandbox
The Illusion of Deno's "Secure by Default" Model
Why --allow-run and Permission Prompts Don't Make Deno Safe
The title weakens an otherwise pretty good article.
[1] https://march-lang.org/docs/capabilities/#the-problem-they-s...
This is genuinely useful in a language, but I suspect it’s also pretty weak. Serious capability systems have capabilities that are instances of types, and two instances are not necessarily the same. For example, the capability to read one file is not the capability to read another file. Singletons may still exist: the capability to read the system clock could reasonably be a singleton. (Or not: one may reasonably debate whether the cycle counter and the realtime clock are instances of the same type or not, and you’ll find that mainstream languages have what amount to very different answers to this sort of question.)
I liked the security model because at least they had something, unlike node.
> It does not provide security guarantees in the presence of malicious code. Malicious code can bypass the permission model and execute arbitrary code without the restrictions imposed by the permission model.
The permission model is more of a "help developers not accidentally "rm -rf /" their local machine than it is something that helps end users.
It’s for executing untrusted code written by others… a large subset of Javascript which guarantees the code can only call the Facades you inject, and you can hook and intercept anything. It works with callbacks and promises.
What’s more is that it runs in WebWorker sandboxes on the web, and uses a proxy to transparently make existing code make same method calls, or use existing objects, like window.document, but to safer versions, which only allow eg createElement.
And because SafeScript automatically awaits every async function, your synchronous calls to HTMLElement methods etc. will be proxied asynchronously and “just work” without changing the original JS code. SafeScript is robust enough that most existing JS components will simply work without changes when ported to SafeScript.
PS: It can also be embedded in PHP, so you can run untrusted handlers there, too, without worrying about PHP’s large security surface.
PPS: SafeScript is deterministic by default, so you can also get the same results across all environments or runs. You can set the random number generator seed yourself, or inject Date.now() as one of your APIs if you want.
Here it is. Should I do a Show HN?
https://github.com/SafeScript/Safescript
My plan was to encode to Unicode (lossily), strip out control characters, and add some visual framing. Anything else I should be considering? Is there a standard approach? Haven't actually done the research on this yet, but since it came up here, I figure someone might know.
(This is https://codeberg.org/timmc/breakmancer if anyone is interested.)
I may have misstated the problem above. What I really need to ensure is that a malicious output can't say "the digest is abc123" and trick the user into pasting that into the other program (when the real digest is def456).
Terminals can be configured to render emoji in text presentation form where they become monochrome glyphs that can be colored like ordinary text with escape sequences. Not something to hinge your security model on.
I was a fan of Deno from the beginning, but not targeting NodeJS compatibility at the beginning turned out to be the wrong move. Now Bun gets to be Anthropic's testbed for the future of software development. (Which includes the wholesale plagiarism and optimization of Oxc into its codebase, wowza.)
Side note: `deno fmt` is a great Markdown formatter. I might get around to extracting out just that part of it.
It is self-centered and narcissistic. Why? WTFRU. An opinion isn't an argument. You have to have reasons beyond your opinions and those are what matter. Lead with those, and your opinion is implied by the fact you are talking about it.
Deno's Security Model is a False Sense of Security
Deno's Permissions Are Not a Sandbox
The Illusion of Deno's "Secure by Default" Model
Why --allow-run and Permission Prompts Don't Make Deno Safe
The title weakens an otherwise pretty good article.