Hacker News Reader

What are the security implications for hosting IHaskell on a server and giving public access to notebooks? For myself, Emacs + Intero + stack makes a near perfect development environment, but IHaskell looks great for writing online books and educational material.

View on HN

Once notebooks have been created, they are just json files that get rendered to html so there's no haskell or python code running. If you're allowing other people to upload notebooks though, you'll want to sandbox them inside an iframe to prevent xss attacks - at work we do this, but allow some channels of communication using the postmessage API.

What happens when I execute a notebook that you wrote, that had Haskell magics in it? Surely the server will run that code? And it might have exploitable bugs?

Reply on news.ycombinator.com