Deno: JavaScript Runtime for V8 Written in Rust

Re:Deno: JavaScript Runtime for V8 Written in Rust by trias on Monday January 20, 2020 @07:28PM (#22103247)

- no file system access - no internet access - no environment access

also loads code from the internet and runs it no questions asked.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by frank2 on Monday January 20, 2020 @07:31PM (#22103258)

When invoking the deno command, the user has the option to grant or deny the command access to the file system, internet, environment.

>loads code from the internet and runs it no questions asked

I think this is a reference to the fact that Deno uses "Ecmascript modules" referenced as URLs the same way modern browsers do.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by leeoniya on Monday January 20, 2020 @07:52PM (#22103364)

yeah i thought that, too. but assuming the loaded code has no access to any of those things either, then i'm not sure what the concern is. though if you gave network access to your code and it loaded other code from the internet which inherited those permissions, that's pretty terrifying (especially since it's not some edge case) - i assume this has been thought through, since it's so obvious.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by PudgePacket on Monday January 20, 2020 @08:00PM (#22103408)

.... except it does ask questions

Goal 2

Provide Secure Defaults

    Unless specifically allowed [by the user], scripts can't access files, the environment, or the network.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by wmf on Monday January 20, 2020 @09:43PM (#22103912)

That doesn't mean what you think. See https://deno.land/std/manual.md#linking-to-third-party-code

"Note that we did not have to provide the --allow-net flag for this program, and yet it accessed the network. The runtime has special access to download imports and cache them to disk."

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by PudgePacket on Monday January 20, 2020 @10:40PM (#22104141)

I don't understand what you're trying to say?

Deno the privileged runtime can do these things, but the scripts/code you get it to run cannot do these things without permission.

Specifically I was talking about this section of the posters comment "runs it no questions asked". No, it will _not_ be run no questions asked.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by kevinkassimo on Monday January 20, 2020 @09:51PM (#22103943)

By default remote imports does allow network access, but when running the downloaded scripts, they subject to network permission settings.

Also if you are just worried about any remote imports anyways, there is a `--no-remote` (turn off http[s] resolution) and `--cached-only` (only resolve remote module if it is already downloaded and saved in cache) flag on `deno run`

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by wmf on Monday January 20, 2020 @07:44PM (#22103316)

loads code from the internet and runs it no questions asked

Like every "modern" package manager? I think that's a lost cause.

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by Snelius on Monday January 20, 2020 @11:54PM (#22104401)

What about versions of that url based packages?

[ Parent | on HN ]

Re:Deno: JavaScript Runtime for V8 Written in Rust by 52-6F-62 on Monday January 20, 2020 @08:10PM (#22103462)

By default it blocks network access... at least in my experience

[ Parent | on HN ]