News for hackers. Stuff that matters.

A comment on The Bytecode Alliance: Building a secure, composable future for WebAssembly. Parent comment

Re:The Bytecode Alliance: Building a secure, composable futu... by weberc2 on Tuesday November 12, 2019 @02:45PM (#21517383)
> Imagine extensions for applications or databases, written in any language you want, with no ability to exfiltrate data

How does Java preclude plugins exfiltrating data?

Downvoters: I’m not trying to be sacrilegious; I genuinely don’t know the answer.

[ Parent | on HN ]
Re:The Bytecode Alliance: Building a secure, composable futu... by chii on Tuesday November 12, 2019 @07:08PM (#21519664)
You can use a security manager and define permission on what the loaded java code can do.

Unfortunately, it's fraught with danger because of the confused lieutenant issue ( you'd need to give parts of the app permission but not others - doing so isn't trivial).

[ Parent | on HN ]
Re:The Bytecode Alliance: Building a secure, composable futu... by scolby33 on Wednesday November 13, 2019 @11:48AM (#21526171)
Just to help others searching for "confused lieutenant," I believe it's usually known as the "confused deputy problem," perhaps as a reference to Barney Fife. I do like the image of a confused lieutenant though.
[ Parent | on HN ]