Show HN: Sandworm.js – Easy auditing and sandboxing for JavaScript dependencies

github.com

10 pointssebivaduva3 comments

Hmmm wouldn't you want to intercept syscalls at the kernel level like AppArmor instead of at the application level?

This is cool though

Thanks!

Yes you can (and should) also intercept at kernel level, but the kernel can't tell which of your app's dependencies is responsible for the call, only the application knows that.

Reply on news.ycombinator.com