Live data from Hacker News

Show HN: Game where you write Python robots to fight other players

robotgame.org

11–20 of 102 posts

Re: Show HN: Game where you write Python robots to fight other players

#12
post #7

interesting! Question regarding the security restrictions - why disable built-ins such as `all`, `set`, `list`, `enumerate`, `min`, `sum`, `sorted`, etc?

To be honest I copied it from `safe_builtins` from RestrictedPython:

https://pypi.python.org/pypi/RestrictedPython

I realize this is annoying, and ideally I shouldn't even be doing this. It was just a quick hack for the version 1. I'll probably try to run user scripts in something like Docker. Any suggestions would be appreciated.

Re: Show HN: Game where you write Python robots to fight other players

#14
post #12
post #7

interesting! Question regarding the security restrictions - why disable built-ins such as `all`, `set`, `list`, `enumerate`, `min`, `sum`, `sorted`, etc?

To be honest I copied it from `safe_builtins` from RestrictedPython: https://pypi.python.org/pypi/RestrictedPython I realize this is annoying, and ideally I shouldn't even be doing this. It was just a quick hack for the version 1. I'll probably try to run user scripts in something like Docker. Any suggestions would be appreciated.

Yeah, this is honestly the most troublesome part. I really want to play with it though.

Re: Show HN: Game where you write Python robots to fight other players

#15
post #6

Hey, I think something that would make the experience a lot better would be to incorporate Ace editor into it, so you get a very well-featured editor incase you don’t have easy access to a better-than- editor.

Thanks for the idea! Yeah, I'm thinking it would be ideal if eventually there could be some kind of IDE on the site with simulator and all (like on fightcodegame.com).

Re: Show HN: Game where you write Python robots to fight other players

#18

Brandon - what methods are you using to run untrusted Python code in a secure sandbox?

Right now what I'm doing is:

1. search code for double underscores (to block magic methods)

2. replace `__builtins__` with a whitelisted version

3. hook `__import__` to only allow a whitelist

4. hook `getattr` to reject any key containing double underscores

Post reply on HN