Hacker News Reader

Comment by Tistron | Hacker News Reader

For me, something like this is exactly where Deno would shine. I could just run `deno run <script url> --allow-net=YouTube.com --allow-write=.` and not worry about that it could do anything dangerous. Probably the url list would be a bit more complicated, but I could also just blanket allow net without worrying, since allow-read isn't needed.

View on HN

While it's great that Deno is sandboxing code, but I feel like this should be a part of the OS and not the language.

Should it also be the OS's job to sandbox JS from the websites you visit?

Admittedly, that question is made in bad faith -- I know what you mean, even if what you mean isn't necessarily "sandboxing": permissions!

Android and iOS do it right. One OS-level source of truth that manages application-level permissions for the entire machine. When you frame it that way, it becomes clear that Deno asking for rights on a per-run basis is indeed silly, but only in the context of the user experience... not necessarily the core software design.

Do you know if generic sandboxing tools exist? I feel like it should be possible to use Docker and some sort of Firewall to isolate your running application from your system if you're worried about it accessing things that it should be able to. And that way you don't need to worry about using deno or relying on the program being written in a certain framework/language.

Firejail?

I use little snitch on macOS and it provides me almost the same thing you want universally across all my apps.

Reply on news.ycombinator.com