Hacker News Reader

Comment by TeeWEE | Hacker News Reader

Where are they running the code? I could easily write malicious code that would crash the machine on which the code would be running on.

View on HN

I may be wrong here but to address a comment above, my hunch is this is spawning a light, short-lived VM for this, which doesn't eliminate security concerns but would be sandboxed enough to make it tougher.

I was trying to get some info on environment in C++ but unfortunately,

> Oh no, there's a problem with Runnable!

Actually, after playing around the system doesn't seem to be ephemeral, so hopefully something along the lines of Docker as mentioned below.

Yep, there's playpen[0] that's ultimately used as a security sandboxing. This is what's used on the new Rust playpen area: http://playtest.rust-lang.org/ (Not fully ready, still needs some beautifying -- that's why it's on playtest and not the play subdomain).

[0]: https://github.com/thestinger/playpen

transpile it all into js and run in node! (I know this may be limiting for some features/libraries, but only a matter of time.)

See https://www.destroyallsoftware.com/talks/the-birth-and-death... on taking this to an "extreme" -- linux, Gimp on X windows, even Chrome -- transpiled and running in a firefox tab.

Why crash the machine when you can use it? Let's say someone wanted to run a ton of background processes to make a ton of requests to some server for whatever reason.

My guess, something like Docker. It only matters if you can break out of the Linux container.

It used to be trivial to break out of docker containers, if you had root within them. I suspect that is still the case.

Is this serious or just some spreading some FUD? Can you show me an example? Honest question

FUD

Example here: http://blog.bofh.it/debian/id_413

* Got root in the countainer.

* You "know" where that is mapped to on the host, because it is based on the UID of the container which is set as the hostname.

* You configure a trigger to run a script, using that knowledge.

* Code happens on the host, outside the container.

The above example is about LXC and sysfs. We are talking docker which uses aufs.

Indeed, this is an LXC attack, rather than docker-specific.

But, that said, the attack works as specified against docker 0.11.0. Largely because guests do have sysfs mounted at /sys.

Please see this example - http://blog.bofh.it/debian/id_413

Even if the code is sandboxed, it's possible to run outgoing attacks from something like this. The same is of course true of traditional server rentals, EC2, and any other service that gives you an OS instance of your own. The difference, though, is those are (ostensibly) less anonymous.

They may have sandboxed it, using something like lxc-containers.

Reply on news.ycombinator.com