F-Secure has open-sourced its Sandboxed Execution Environment | Hacker News Reader

F-Secure has open-sourced its Sandboxed Execution Environment

github.com

138 pointstilt21 comments

Woah, I was not expecting that. Not only is it in Python but it's nice Python, not the bastardized "I can write C, let's try Python" style you often see from big companies.

That style of Python (the C-oriented, shall we say?) is responsible for a lot of "Python is too slow" comments. I've seen code from big projects where string concatenation and manipulation was done one character at a time...

I don't write python but what makes it nice python?

It uses classes, magic methods where appropriate, is well documented, does its loops in a pythonic way; lots of things! It's taking advantage of idiomatic python, as opposed to simply using python as a C-style hammer.

I wasn't familiar with the "magic methods" term, so for anyone else in the same boat, that refers to the functions like __init__, __repr__, __add__, __hex__, __len__, etc that you can define in your classes to make them work with built in functions like len(custom_listy_thing) or arithmetic.

More than just built in functions, any object that defines a __len__ and a __index__ method (that provide len(x) and x[0] respectively) can also be iterated over in a for loop ('for item in instance'). A good reference for magic methods is [1] for anyone interested.

1. http://www.rafekettler.com/magicmethods.html

As a C programmer who "tried" Python, I feel offended. I wrote substantial OO code using list comperhensions and other things pythonic. I am also a functional programming affectionado, though a realist, not a fan. Don't label people. Speak against companies mismanaging people by driving them to write low quality code. Be open and promote useful programming concepts and tools.

P.S. Long live static typing. Down with EcmaScript.

I'm sorry you feel offended but my comment was not labelling anyone, merely stating surprise that a company I did not know used Python produced a large, idiomatic Python project seemingly out of the blue. Similar projects at other companies might have produced huge OOP classes with LotsOfCamelCase, c-style for loops and other such constructs. Kudos to them and the author.

> Speak against companies mismanaging people by driving them to write low quality code

I don't think that's relevant to my comment, but I would say that it's not some company overlord making people churn out non-idomatic Python code.

when you write C, you should be writing elegant C. when you write Python, you should be writing elegant Python. trying to code Python in C is about as ugly as trying to code C in Python and both should be discouraged equally.

the thing i don't understand is what you took offense at.

Swap the languages around and see if the statement doesn't sound a bit elitist to you. I feel like the parent could have chosen more neutral words if they wanted to. Their particular experience with irreverent/careless programmers just rubbed against my experience with technology fans I guess (the word fans used in the same sense as in my previous comment).

Swapping the languages fits exactly consistently with what GP said.

Trying to use first-class functions and OO paradigms in C is going to bite you in the ass, hard.

Just as iterative pointer manipulations in Python aren't preferable.

Both languages have different "styles" that suit their purposes excellently, but mixing them improperly in either direction will be painful.

    DH2. Responding to Tone.

Slightly off topic, but how well do sandbox execution environments handle malware that only execute if a VM is not detected? AFAIK most virtualization environments are easily detectable by the guest.

The sandbox just provides environment separation to run automated tests independently. How you define the environment, and how malware may react to it, is up to the user. (However, the 'hooks' could in theory be written to circumvent or detect malware looking for signs of a guest VM)

What are the advantages of using this over Cuckoo Sandbox, or Anubis?

Maybe the biggest advantage is the plugin system and how those can be hooked to the execution. Developer focuses on writing a LEGO brick that can be used as a part of execution. Also different plugins do not need to care about existence of other plugins, but on the other hand those plugins can be chained by firing and listening to events.

Cuckoo supports plugins too, I wrote up a summary of them here: https://www.eugenekolo.com/blog/cuckoo-sandbox-notes/#div_cu.... Can also edit the Analyzer/monitor part to add in new function hooks.

Cuckoo is a full-feature behaviour analysis platform which supports extensions via plugins.

SEE is a modular and flexible framework for building sandboxed test automation against generic software.

Focus of SEE design is to speed up the development of behavioural analysis platforms. It allows to choose between several different sandboxing technologies and provides a plugin-based event-driven architecture in order to control them.

SEE is for developers and not for users. If you want an out-of-the-box solution for analysing malware you choose Cuckoo. If you want to develop your own analysis platform, you better try out SEE.

The tool is shown in the video at the following link.

https://www.youtube.com/watch?v=k185OMivqbQ&list=PLJ6grbbdTP...

why would they open source this?

Why not, this is just a general purpose framework for driving virtual machine execution? Hopefully someone will find this useful and write plugins and share those for the community as well.

Reply on news.ycombinator.com