Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scastie: use any Scala compiler and Scala library in the browser

scala-lang.org

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Scastie: use any Scala compiler and Scala library in the browser

#11

Post by masgui »

atemerev wrote: post #8
masgui wrote: post #5

Earlier quoted context omitted.

It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.

I am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload). My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access i…

Yeah disabling networking was an idea. I prefer to leave it open so you can try http client/libraries that access the web. To limit spam, if it becomes an issue we could throttle the connection.

Re: Scastie: use any Scala compiler and Scala library in the browser

#12

Post by clhodapp »

masgui wrote: post #5
atemerev wrote: post #4

(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)

It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.

The general rule is that you want as many layers of security as you can get away with without making things impractically inconvenient. In this case, the first step is probably not letting the user's code run as root in the container. Gaining container-root is going to be the first step in many, many exploits and by letting code just run that way, you are giving a potential attacker that step for free.

Disclaimer: Absolutely not a security expert, just someone who is somewhat on the hook for security!

Re: Scastie: use any Scala compiler and Scala library in the browser

#13

Post by richardwhiuk »

wiradikusuma wrote: post #10

I'm a Scala developer but I don't understand what is Scastie. How does it benefit from the perspective of developers like me?

It's an interactive playground for Scala so you can share code and send it to other people.

https://scastie.scala-lang.org/

Re: Scastie: use any Scala compiler and Scala library in the browser

#14

Post by masgui »

aghll0ihph2bbe8 wrote: post #2

How am I supposed to dismiss this modal window? http://i.imgur.com/atx6KsX.png

hum this look like a but in safari https://github.com/scalacenter/scastie/issues/. You can visit this link: https://scastie.scala-lang.org/MasseGuillaume/kHn9lemPTayxoY... and it will clear the modal.

Re: Scastie: use any Scala compiler and Scala library in the browser

#16

Post by ronjouch »

masgui wrote: post #5
atemerev wrote: post #4

(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)

It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.

Thumbs up for the honest upfront response!

Maybe Jessica McKellar's "Building and Breaking a Python Sandbox" talk can bring some ideas. (But maybe not! It might be too Python-specific or too language-level whereas you want to remain at a higher level with just Docker)

Video: https://www.youtube.com/watch?v=sL_syMmRkoU

Slides: https://speakerdeck.com/pycon2014/building-and-breaking-a-py...

Re: Scastie: use any Scala compiler and Scala library in the browser

#17

Post by masgui »

mark_l_watson wrote: post #15

This looks cool, I just experimented with it. I am curious: what is the business model for this? Server costs are probably fairly expensive.

We are the [Scala Center](https://scala.epfl.ch). We are a non-profit organization. Our revenue is from donations. This service will be forever free.

Re: Scastie: use any Scala compiler and Scala library in the browser

#19

Post by j_s »

masgui wrote: post #5
atemerev wrote: post #4

(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)

It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.

I recommend to at least wrap all the containers in a VM between the docker containers and your server-side orchestration code.

SELinux also helps, from what I've read.

https://news.ycombinator.com/item?id=14245428

Re: Scastie: use any Scala compiler and Scala library in the browser

#20

Post by wsargent »

masgui wrote: post #5
atemerev wrote: post #4

(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)

It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.

I put together a list of security tips:

https://github.com/wsargent/docker-cheat-sheet#security-tips

Probably the biggest one is to use Virtualbox or another virtual machine so that Docker isn't your only line of defence.

Post reply on HN