$ sudo rm -rf / === NPM install

Re:$ sudo rm -rf / === NPM install by mxey on Tuesday November 09, 2021 @08:28AM (#29161416)

The cloud environment where the code runs might be ephemeral, but it would most likely have access to some not so ephemeral resources that should still be protected.

If one wants to go sandboxing, the right place for it would be in npm, where packages should not be able to modify anything but themselves.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @08:37AM (#29161525)

Don’t think within a package manager is the right place. Fundamentally there needs to be an onion layer around the entire activity (ie. a virtual machine, qubeos, oci/container, gitpod, github codespaces, namespace jail).

Example of tasty file that a package manager should never be able to read: /Users/mxey/.ssh/ssh_rsa or /Users/mxey/.netrc

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by thingification on Tuesday November 09, 2021 @03:02PM (#29166723)

Fundamentally according to what theory?

https://medium.com/agoric/pola-would-have-prevented-the-even...

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @03:23PM (#29166958)

Lovely, I had not seen this post before. Thank you for sharing.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by teptoria on Tuesday November 09, 2021 @07:27PM (#29169499)

Great read. Thanks for sharing

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @08:55AM (#29161735)

ssh_rsa shouldn't be readable to browser, Spotify, Zoom or whatever is currently running. And browser files should be isolated from any other process etc.

Linux security model (and I suppose other OSes too, but I'm most familiar with) is fundamentally incompatible with desktop environments. Mobile OSes got it much better.

I love Snap because it confines processes to sandbox.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by kevinmgranger on Tuesday November 09, 2021 @01:41PM (#29165575)

Linux _does_ have SELinux. It's just too confusing to use.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @07:35PM (#29169562)

It's unusable for anyone but few highly qualified sysadmins.

If good security isn't easily obtainable for tech-savvy person in one hour, there is basically no security.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by mxey on Tuesday November 09, 2021 @11:31AM (#29163840)

It has to be on the level of the package manager, if you want to avoid package A interfering with package B

[ Parent | on HN ]