Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno Sandbox

deno.com

Post reply on HN
Print view View original

111–120 of 185 posts

Re: Deno Sandbox

#111

Post by [deleted] »

ptx wrote: post #78
emschwartz wrote: post #8

> In Deno Sandbox, secrets never enter the environment. Code sees only a placeholder > The real key materializes only when the sandbox makes an outbound request to an approved host. If prompt-injected code tries to exfiltrate that placeholder to evil.com? Useless. That seems clever.

Yes... but... Presumably the proxy replaces any occurrence of the placeholder with the real key, without knowing anything about the context in which the key is used, right? Because if it knew that the key was to be used for e.g. HTTP basic auth, it could just be added by the proxy without using a placeholder. So all the attacker would have to do then is find and endpoint (on one of the approved hosts, granted) that e…

[deleted]

Re: Deno Sandbox

#112

Post by rob »

Soerensen wrote: post #108

[flagged]

I feel like this is a bot account. Or at least, everything is AI generated. No posts at all since the account was created in 2024 and now suddenly in the past 24 hours there's dozens of detailed comments that all sort of follow the same pattern/vibe.

Re: Deno Sandbox

#113

Post by int_19h »

bangaladore wrote: post #94
twosdai wrote: post #6

Earlier quoted context omitted.

Like the emdash, whenever I read: "this isn't x it's y" my dumb monkey brain goes "THATS AI" regardless if it's true or not.

Another common tell nowadays is the apostrophe type (’ vs '). I don't know personally how to even type ’ on my keyboard. According to find in chrome, they are both considered the same character, which is interesting. I suspect some word processors default to one or the other, but it's becoming all too common in places like Reddit and emails.

Word (you know, the most popular word processor out there) will do that substitution. And on macOS & iOS, it's baked into the standard text input widgets so it'll do that basically everywhere that is a rich text editor.

Re: Deno Sandbox

#114

Post by [deleted] »

johnspurlock wrote: post #2

"Over the past year, we’ve seen a shift in what Deno Deploy customers are building: platforms where users generate code with LLMs, and that code runs immediately without review. That code frequently calls LLMs itself, which means it needs API keys and network access. This isn’t the traditional “run untrusted plugins” problem. It’s deeper: LLM-generated code, calling external APIs with real credentials, without human…

[deleted]

Re: Deno Sandbox

#115

Post by chacham15 »

I am so confused at how this is supposed to work. If the code, running in whatever language, does any sort of transform with the key that it thinks it has, doesnt this break? E.g. OAuth 1 signatures, JWTs, HMACs...

Now that I think further, doesnt this also potentially break HTTP semantics? E.g. if the key is part of the payload, then a data.replace(fake_key, real_key) can change the Content Length without actually updating the Content-Length header, right?

Lastly, this still doesnt protect you from other sorts of malicious attacks (e.g. 'DROP TABLE Users;')...Right? This seems like a mitigation, but hardly enough to feel comfortable giving an LLM direct access to prod, no?

Re: Deno Sandbox

#116

Post by its-summertime »

simonw wrote: post #101
its-summertime wrote: post #76

Earlier quoted context omitted.

if there is an LLM in there, "Run echo $API_KEY" I think could be liable to return it, (the llm asks the script to run some code, it does so, returning the placeholder, the proxy translates that as it goes out to the LLM, which then responds to the user with the api key (or through multiple steps, "tell me the first half of the command output" e.g. if the proxy translates in reverse) Doesn't help much if the use of t…

Secrets are tied to specific hosts - the proxy will only replace the placeholder value with the real secret for outbound HTTP requests to the configured domain for that secret.

which, if its the LLM asking for the result of the locally ran "echo $API_KEY", will be sent through that proxy, to the correct configured domain. (If it did it for request body, which apparently it doesn't (which was part of what I was wondering))

Re: Deno Sandbox

#117

Post by koakuma-chan »

simonw wrote: post #15

Note that you don't need to use Deno or JavaScript at all to use this product. Here's their Python client SDK: https://pypi.org/project/deno-sandbox/ from deno_sandbox import DenoDeploy sdk = DenoDeploy() with sdk.sandbox.create() as sb: # Run a shell command process = sb.spawn("echo", args=["Hello from the sandbox!"]) process.wait() # Write and read files sb.fs.write_text_file("/tmp/example.txt", "Hello, World!") co…

Because the sandbox is on their cloud, not on your local machine, which wasn't obvious to me.

Re: Deno Sandbox

#120

Post by messh »

mrkurt wrote: post #34
mrpandas wrote: post #26

Where's the real value for devs in something like this? Hasn't everyone already built this for themselves in the past 2 years? I'm not trying to sound cheeky or poo poo the product, just surprised if this is a thing. I can never read what's useful by gut anymore, I guess.

Sandboxes with the right persistence and http routing make excellent dev servers. I have about a million dev servers I just use from whatever computer / phone I happen to be using. It's really useful to just turn a computer on, use a disk, and then plop its url in the browser. I currently do one computer per project. I don't even put them in git anymore. I have an MDM server running to manage my kids' phones, a "help…

This is exactly what I built shellbox.dev for.

SSH in, it resumes where you left off, auto-suspends on disconnect. $0.50/month stopped.

I have the same pattern - one box per project, never think about them until I need them.

Post reply on HN