Hacker News Reader

Why? You still get full access to everything the app can see - all Confluence content. To prevent access to the rest of the system, there are better ways now (Containers). YMMV, but SecurityManager was never really usable in most real word use cases.

View on HN

> You still get full access to everything the app can see - all Confluence content.

No (with proper policy in place). That's the whole point of SecurityManager. Even if you can execute code - it is sandboxed and has limited (or none at all) permissions.

To be fair, with most stuff running as VMs, a confluence server will usually not run anything else. So root doesn't really change much here I guess.

VM might have access to more cloud resources via bad AIM policies. Getting access to root even in container can be just as bad.

Reply on news.ycombinator.com