2026-09-30 22:41 UTC
i can't believe sandboxing has been a solved problem since 1994. why don't we simply remove the language features that can do harm https://www.guppylake.com/nsb/pubs/ulpaa-94.pdf
Replies (1)
-
@fugueish@wandering.shop 2026-09-30 23:10
@joe@f.duriansoftware.com Something tells me attempts to do Caja for TCL would end the same way Caja for JS did. :) But! If you could feasibly and reliably allowlist the objects in the execution context, the idea makes sense. The problem is Spicy Object Graph Connectivity, moreso than that the idea could never work in principle.