Hacker News Reader

Java and C# to my understanding are intended to be run in an untrusted way and can cause segfaults or take over the surrounding process (with JNI or C# unsafe). With something like wasmtime I can have untrusted user code in the same process that I have. This means I can do things like have really low-latency interconnect or start running a user's code in microseconds.

View on HN

You can just deny the process access to JNI; it's not too difficult assuming you've patched the JDK appropriately.

Running untrusted java code sounds like a nightmare. And saying you can do something in java if you've "patched the JDK appropriately"... How is that even comparable to a 100% sandboxed by default vm and runtime?

You patch the JDK because it doesn’t make sense to try to access the filesystem if there is no filesystem, lol. The JVM is sandboxed, it’s the APIs you give it that let it break out.

Reply on news.ycombinator.com