$ sudo rm -rf / === NPM install

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @08:37AM (#29161525)

Don’t think within a package manager is the right place. Fundamentally there needs to be an onion layer around the entire activity (ie. a virtual machine, qubeos, oci/container, gitpod, github codespaces, namespace jail).

Example of tasty file that a package manager should never be able to read: /Users/mxey/.ssh/ssh_rsa or /Users/mxey/.netrc

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by thingification on Tuesday November 09, 2021 @03:02PM (#29166723)

Fundamentally according to what theory?

https://medium.com/agoric/pola-would-have-prevented-the-even...

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by ghuntley on Tuesday November 09, 2021 @03:23PM (#29166958)

Lovely, I had not seen this post before. Thank you for sharing.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by teptoria on Tuesday November 09, 2021 @07:27PM (#29169499)

Great read. Thanks for sharing

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @08:55AM (#29161735)

ssh_rsa shouldn't be readable to browser, Spotify, Zoom or whatever is currently running. And browser files should be isolated from any other process etc.

Linux security model (and I suppose other OSes too, but I'm most familiar with) is fundamentally incompatible with desktop environments. Mobile OSes got it much better.

I love Snap because it confines processes to sandbox.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by kevinmgranger on Tuesday November 09, 2021 @01:41PM (#29165575)

Linux _does_ have SELinux. It's just too confusing to use.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by Ginden on Tuesday November 09, 2021 @07:35PM (#29169562)

It's unusable for anyone but few highly qualified sysadmins.

If good security isn't easily obtainable for tech-savvy person in one hour, there is basically no security.

[ Parent | on HN ]

Re:$ sudo rm -rf / === NPM install by mxey on Tuesday November 09, 2021 @11:31AM (#29163840)

It has to be on the level of the package manager, if you want to avoid package A interfering with package B

[ Parent | on HN ]