Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno Sandbox

deno.com

Post reply on HN
Print view View original

91–100 of 185 posts

Re: Deno Sandbox

#91

Post by tptacek »

booi wrote: post #80
ptx wrote: post #78

Earlier quoted context omitted.

Yes... but... Presumably the proxy replaces any occurrence of the placeholder with the real key, without knowing anything about the context in which the key is used, right? Because if it knew that the key was to be used for e.g. HTTP basic auth, it could just be added by the proxy without using a placeholder. So all the attacker would have to do then is find and endpoint (on one of the approved hosts, granted) that e…

Where would this happen? I have never seen an API reflect a secret back but I guess it's possible? perhaps some sort of token creation endpoint?

It depends on where you allow the substitution to occur in the request. It's basically "the big bug class" you have to watch out for in this design.

Re: Deno Sandbox

#92

Post by kommunicate »

ATechGuy wrote: post #40
falcor84 wrote: post #29

Earlier quoted context omitted.

> Hasn't everyone already built this for themselves in the past 2 years? The short answer is no. And more so, I think that "Everyone I know in my milieu already built this for themselves, but the wider industry isn't talking about it" is actually an excellent idea generator for a new product.

In the last one year, we have seen several sandboxing wrappers around containers/VMs and they all target one use case AI agent code execution. Why? perhaps because devs are good at building (wrappers around VMs) and chase the AI hype. But how are these different and what value do they offer over VMs? Sounds like a tarpit idea, tbh. Here's my list of code execution sandboxing agents launched in the last year alone: E2…

don't forget runloop!

Re: Deno Sandbox

#93

Post by kommunicate »

ATechGuy wrote: post #70
ushakov wrote: post #65

Earlier quoted context omitted.

why? because there’s a huge market demand for Sandboxes. no one would be building this if no one would be buying. disclaimer: i work at E2B

I'm not saying sandboxes are not needed, I'm saying VMs/containers already provide the core tech and it's easy to DIY a sandbox. Would love to understand what value E2B offers over VMs?

making a local sandbox using docker is easy, but making them work at high volume and low latency is hard

Re: Deno Sandbox

#94

Post by bangaladore »

twosdai wrote: post #6
johnspurlock wrote: post #2

"Over the past year, we’ve seen a shift in what Deno Deploy customers are building: platforms where users generate code with LLMs, and that code runs immediately without review. That code frequently calls LLMs itself, which means it needs API keys and network access. This isn’t the traditional “run untrusted plugins” problem. It’s deeper: LLM-generated code, calling external APIs with real credentials, without human…

Like the emdash, whenever I read: "this isn't x it's y" my dumb monkey brain goes "THATS AI" regardless if it's true or not.

Another common tell nowadays is the apostrophe type (’ vs ').

I don't know personally how to even type ’ on my keyboard. According to find in chrome, they are both considered the same character, which is interesting.

I suspect some word processors default to one or the other, but it's becoming all too common in places like Reddit and emails.

Re: Deno Sandbox

#95

Post by ushakov »

yakkomajuri wrote: post #90

Secret placeholders seems like a good design decision. So many sandbox products these days though. What are people using in production and what should one know about this space? There's Modal, Daytona, Fly, Cloudflare, Deno, etc

Factory, Nvidia, Perplexity and Manus are using E2B in production - we ran more than 200 million Sandboxes for our customers

Re: Deno Sandbox

#96

Post by mananaysiempre »

booi wrote: post #80
ptx wrote: post #78

Earlier quoted context omitted.

Yes... but... Presumably the proxy replaces any occurrence of the placeholder with the real key, without knowing anything about the context in which the key is used, right? Because if it knew that the key was to be used for e.g. HTTP basic auth, it could just be added by the proxy without using a placeholder. So all the attacker would have to do then is find and endpoint (on one of the approved hosts, granted) that e…

Where would this happen? I have never seen an API reflect a secret back but I guess it's possible? perhaps some sort of token creation endpoint?

Say, an endpoint tries to be helpful and responds with “no such user: foo” instead of “no such user”. Or, as a sibling comment suggests, any create-with-properties or set-property endpoint paired with a get-propety one also means game over.

Relatedly, a common exploitation target for black-hat SEO and even XSS is search pages that echo back the user’s search request.

Re: Deno Sandbox

#97

Post by paxys »

ttoinou wrote: post #3

What happens if we use Claude Pro or Max plans on them ? It’ll always be a different IP connecting and we might get banned from Anthropic as they think we’re different users Why limit the lifetime on 30 mins ?

What's the use case for this? Trying to get raw API access through a monthly plan? Or something else?

Re: Deno Sandbox

#98

Post by WatchDog »

If you achieve arbitrary code execution in the sandbox, I think you could pretty easily exfiltrate the openai key by using the openai code interpreter, and asking it to send the key to a url of your choice.

Re: Deno Sandbox

#99

Post by jkelleyrtp »

emschwartz wrote: post #8

> In Deno Sandbox, secrets never enter the environment. Code sees only a placeholder > The real key materializes only when the sandbox makes an outbound request to an approved host. If prompt-injected code tries to exfiltrate that placeholder to evil.com? Useless. That seems clever.

@deno team, how do secrets work for things like connecting to DBs over a tcp connection? The header find+replace won't work there, I assume. Is the plan to add some sort of vault capability?

Re: Deno Sandbox

#100

Post by Tomuus »

ryanrasti wrote: post #48
simonw wrote: post #13

Earlier quoted context omitted.

Yeah, this is a really neat idea: https://deno.com/blog/introducing-deno-sandbox#secrets-that-... await using sandbox = await Sandbox.create({ secrets: { OPENAI_API_KEY: { hosts: ["api.openai.com"], value: process.env.OPENAI_API_KEY, }, }, }); await sandbox.sh`echo $OPENAI_API_KEY`; // DENO_SECRET_PLACEHOLDER_b14043a2f578cba75ebe04791e8e2c7d4002fd0c1f825e19... It doesn't prevent bad code from USING those secrets to d…

> It doesn't prevent bad code from USING those secrets to do nasty things, but it does at least make it impossible for them to steal the secret permanently. Agreed, and this points to two deeper issues: 1. Fine-grained data access (e.g., sandboxed code can only issue SQL queries scoped to particular tenants) 2. Policy enforced on data (e.g., sandboxed code shouldn't be able to send PII even to APIs it has access to)…

Object capabilities, like capnweb/capnproto?
Post reply on HN