Oh, this is right up my street. I love the minimal UI.
Show HN: Game where you write Python robots to fight other players
21–30 of 102 posts
Re: Show HN: Game where you write Python robots to fight other players
#22Similar to crobots ( http://en.wikipedia.org/wiki/Crobots ).
Or, more notably, Robocode (http://en.wikipedia.org/wiki/Robocode)
Re: Show HN: Game where you write Python robots to fight other players
#23Brandon - what methods are you using to run untrusted Python code in a secure sandbox?
Right now what I'm doing is: 1. search code for double underscores (to block magic methods) 2. replace `__builtins__` with a whitelisted version 3. hook `__import__` to only allow a whitelist 4. hook `getattr` to reject any key containing double underscores
Many of the builtins that are disabled seem quite harmless to me (especially something like "min"). Curious how you decided which ones to disable.
Re: Show HN: Game where you write Python robots to fight other players
#24Brandon - what methods are you using to run untrusted Python code in a secure sandbox?
Right now what I'm doing is: 1. search code for double underscores (to block magic methods) 2. replace `__builtins__` with a whitelisted version 3. hook `__import__` to only allow a whitelist 4. hook `getattr` to reject any key containing double underscores
You may want to bear in mind that, at least last I knew, the official position of the CPython dev team is that it is not possible to sandbox CPython.
If they can't do it....
At any rate it is certainly not as simple as that, and not only is it not as simple as that, it is not even close to being that simple.
In fact, I recall warning people off of this exact project many years ago on comp.lang.python.
This seems up-to-date: https://wiki.python.org/moin/Asking%20for%20Help/How%20can%2... It looks like the only even remotely feasible option is PyPy, and this link doesn't look like much fun: https://pypi.python.org/pypi/RestrictedPython/ It looks to me like you'd still have many, many opportunities to end up with holes in the system.
I really, really don't recommend Python for this.
You might find this interesting: http://blog.delroth.net/2013/03/escaping-a-python-sandbox-nd... (And before you go "Oh, I've got that blocked"... read it, like, really really read it, not just skim for "one thing I can do to block that stuff", but to see just how many things there are in Python for this sort of hackery. Personally I'd guess the "I blocked double-underscores" would not have slowed them down much.)
Re: Show HN: Game where you write Python robots to fight other players
#25This looks like an ideal use case for ZeroVM [1].
Re: Show HN: Game where you write Python robots to fight other players
#26Any suggestions for the language? The game and site are written in Python so that seemed most natural, plus it's a high-level language with a simple syntax. I could add more if people wanted though.
Maybe Lua would be a good candidate? From the usages I have seen of Lua, it could match the use case.
Re: Show HN: Game where you write Python robots to fight other players
#27Earlier quoted context omitted.
Right now what I'm doing is: 1. search code for double underscores (to block magic methods) 2. replace `__builtins__` with a whitelisted version 3. hook `__import__` to only allow a whitelist 4. hook `getattr` to reject any key containing double underscores
You may want to bear in mind that, at least last I knew, the official position of the CPython dev team is that it is not possible to sandbox CPython. If they can't do it.... At any rate it is certainly not as simple as that, and not only is it not as simple as that, it is not even close to being that simple. In fact, I recall warning people off of this exact project many years ago on comp.lang.python. This seems up-t…
This. You _will_ get compromised. Maybe not today or tomorrow but it is inevitable.
Re: Show HN: Game where you write Python robots to fight other players
#28You need to say somewhere that: python kit/run.py yourcode.py yourothercode.py map.py --render is required to view the simulation. The "--render" argument doesn't seem to be mentioned anywhere on the site.
Right you are. Let me add that.
Re: Show HN: Game where you write Python robots to fight other players
#29Is this anything like Robocode?
http://robocode.sourceforge.net/
Because I had an amazing time in high school doing some local Robocode competitions. This could really bring some memories back.
Edit: Ahh, I see, it appears to be a sort of discrete turn-based version.
Re: Show HN: Game where you write Python robots to fight other players
#30Earlier quoted context omitted.
You may want to bear in mind that, at least last I knew, the official position of the CPython dev team is that it is not possible to sandbox CPython. If they can't do it.... At any rate it is certainly not as simple as that, and not only is it not as simple as that, it is not even close to being that simple. In fact, I recall warning people off of this exact project many years ago on comp.lang.python. This seems up-t…
This. You _will_ get compromised. Maybe not today or tomorrow but it is inevitable.
>This.
Obvious samefag is obvious. Go back to 4chan kthxbai.