Discussion
If you run a Node.js server, start it with --permission and grant only what it needs:
— No network access if it only reads files
— Limit file access to the directories it actually uses
Here's how I locked down Slow Reader's server:
https://github.com/hplush/slowreader/commit/25b5730374eefd2591a8729efe219c5d64534277
@sorin honestly, I do not really like the tradition of security promises when it is 90% but not 100% solution.
For instance, often people tell that Docker is not a sandbox. It is true that it is not 100% protection, but don't have Dev Container is big security downgrade.
Here we have the same 90% sandbox. Those 10% should not be a reason to not use it. And our wording should explain that it is almost sandbox (I think my wording is correct since I do not promise absolute protection).
Install Fedizen
Get the full app experience
@sitnik_en It's a bit misleading to call Node's permission model a sandbox. The documentation explicitly says that "it does not provide security guarantees in the presence of malicious code".