Re:GraalVM: The holy graal of polyglot JVM?
by rthrowayay on Monday September 16, 2019 @06:29PM
(#20989185)
Customers running js on your server in a Java VM doesn't sound very secure. I could be wrong but when I see Java I get the suspicion that user code and privileged server code are running in the same process. Of course they could have a properly sandboxed java process and are just using Java because that is what they are familiar with.
[ Parent
| on HN ]
Re:GraalVM: The holy graal of polyglot JVM?
by andrewvc on Monday September 16, 2019 @06:45PM
(#20989319)
That perspective is somewhat dated to be blunt. A modern Java deployment would be identical security wise to node, with one app per Java process running with the minimum of privileges.
Re:GraalVM: The holy graal of polyglot JVM?
by sk5t on Monday September 16, 2019 @11:05PM
(#20990957)
I think you are being very polite here. Fearing the JRE/JVM in this particular way falls somewhere between superstitious and ignorant.
Re:GraalVM: The holy graal of polyglot JVM?
by EdwardDiego on Tuesday September 17, 2019 @06:35AM
(#20993486)
I have no worries, because I make sure to sacrifice chickens to my Tomcat apps each day. Although going into the cloud is making it trickier, chickens generally can't fly that high.
Re:GraalVM: The holy graal of polyglot JVM?
by rthrowayay on Tuesday September 17, 2019 @06:18AM
(#20993419)
It is unsafe to mix trusted and untrusted code in the same process. This is why Chrome runs the renderer in a separate process. My concern is that using Java to execute JS increases the probability they are doing this bad mixing. They could be doing it safely but it increases my suspicion.