Scastie: use any Scala compiler and Scala library in the browser
1–10 of 34 posts
Re: Scastie: use any Scala compiler and Scala library in the browser
#2How am I supposed to dismiss this modal window? http://i.imgur.com/atx6KsX.png
Re: Scastie: use any Scala compiler and Scala library in the browser
#3Hi Heather!
Looks like you've got a Hacker News effect on your shoulders. :) Servers seem to be overloaded.
Re: Scastie: use any Scala compiler and Scala library in the browser
#4(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
Re: Scastie: use any Scala compiler and Scala library in the browser
#5(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
Re: Scastie: use any Scala compiler and Scala library in the browser
#6(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
/etc/shadow works as well :S But there are not encrypted bits in it.
Re: Scastie: use any Scala compiler and Scala library in the browser
#7Hi Heather! Looks like you've got a Hacker News effect on your shoulders. :) Servers seem to be overloaded.
Working for me (TM).
Re: Scastie: use any Scala compiler and Scala library in the browser
#8(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
I am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload).
My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access is enabled). I think it is a good idea to at least disable networking. (Update: and use a minimal Docker image like Alpine Linux).
Proof:
[__REDACTED__]
Re: Scastie: use any Scala compiler and Scala library in the browser
#9Hi Heather! Looks like you've got a Hacker News effect on your shoulders. :) Servers seem to be overloaded.
Nah, that's probably just Hacker Effect of people rebooting the container ;).
Re: Scastie: use any Scala compiler and Scala library in the browser
#10I'm a Scala developer but I don't understand what is Scastie. How does it benefit from the perspective of developers like me?