|
People concerned about how to safely run untrusted python code should take a look at . It describes a way to automatically generate a python interpreter that is incapable of communicating over a network, writing files, or any other sort of I/O except for reading from stdin and writing to stdout. Any untrusted python code (i.e. code bundled with an age) gets run in this sandboxed python interpreter, and all the file I/O and networking are handled on it's behalf by another program that acts as a gatekeeper. This controller program is responsible for implementing any security restrictions, so if the sandboxed python asks the controller to write a file in an unapproved location, it would simply refuse. The controller would be part of Uru, so it would be code that users got from a trusted source. As long as it's security policies aren't too permissive, the most that clients would be risking by running untrusted code bundled with an age is that the age would break, resulting in a crash to the desktop or linking to relto.
Of course, the above only solves the original problem of allowing the client to run untrusted python code. It doesn't solve any of the problems like flymode, but it does mean that we can make an Uru client that you can trust to never infect or destroy your system (provided you get an un-tampered Uru client from a trusted source).
|
Login
Register
FAQ
Search
