Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deno Sandbox

deno.com

Post reply on HN
Print view View original

141–150 of 185 posts

Re: Deno Sandbox

#141

Post by signal11 »

twosdai wrote: post #6
johnspurlock wrote: post #2

"Over the past year, we’ve seen a shift in what Deno Deploy customers are building: platforms where users generate code with LLMs, and that code runs immediately without review. That code frequently calls LLMs itself, which means it needs API keys and network access. This isn’t the traditional “run untrusted plugins” problem. It’s deeper: LLM-generated code, calling external APIs with real credentials, without human…

Like the emdash, whenever I read: "this isn't x it's y" my dumb monkey brain goes "THATS AI" regardless if it's true or not.

I’ve been using em-dashes since high school — publishing the school paper and everything. I remain slightly bemused by people discovering em-dashes for the first time thanks to LLMs.

Also, “em-dashes are something only LLMs use” comes perilously close to “huh, proper grammar, must’ve run this by a grammar checker”.

Re: Deno Sandbox

#142

Post by signal11 »

bangaladore wrote: post #94
twosdai wrote: post #6

Earlier quoted context omitted.

Like the emdash, whenever I read: "this isn't x it's y" my dumb monkey brain goes "THATS AI" regardless if it's true or not.

Another common tell nowadays is the apostrophe type (’ vs '). I don't know personally how to even type ’ on my keyboard. According to find in chrome, they are both considered the same character, which is interesting. I suspect some word processors default to one or the other, but it's becoming all too common in places like Reddit and emails.

If you work with macOS or iOS users, you won’t be super surprised to see lots of “curly quotes”. They’re part of base macOS, no extra software required (I cannot remember if they need to be switched on or they’re on by default), and of course mass-market software like Word will create “smart” quotes on Mac and Windows.

I ended up implementing smart quotes on an internal blogging platform because I couldn’t bear "straight quotes". It’s just a few lines of code and makes my inner typography nerd twitch less.

Re: Deno Sandbox

#143

Post by sibellavia »

I just run a local microVM. I built a small CLI that wraps lima to make my life easier. With a few commands I have a VM running locally with all batteries included (CC/Codex, ssh, packages I need, ...). With this I'm not saying Deno or Docker sandboxes are useless.

Re: Deno Sandbox

#144

Post by nusl »

freakynit wrote: post #137

It's always the exorbitant price with such offerings. A 2 vCPU, 4GB Ram and 40GB Disk instance on Hetzner cost 4.13 USD. The same here is: $127.72 without pro plan, and $108.72 with pro plan. This means to break even, I can only use this for 4.13/127.72*730 = 23.6 hours every month, or, less than an hour daily.

The article mentions that it's compute time spent deploying the code and not "wall clock" time, so I don't think it's quite this bad?

Re: Deno Sandbox

#145

Post by nusl »

chacham15 wrote: post #115

I am so confused at how this is supposed to work. If the code, running in whatever language, does any sort of transform with the key that it thinks it has, doesnt this break? E.g. OAuth 1 signatures, JWTs, HMACs... Now that I think further, doesnt this also potentially break HTTP semantics? E.g. if the key is part of the payload, then a data.replace(fake_key, real_key) can change the Content Length without actually u…

My understanding is that it only surfaces the real keys when the request is actually sent under the hood, and doesn't make it available to the code itself, so that LLMs aren't able to query the key values. They have placeholder values for what seems to be obfuscation purposes, so that the LLM receives a fake value if it tries, which would help with stuff like prompt injection since that value is useless.

Re: Deno Sandbox

#146

Post by jrvarela56 »

sibellavia wrote: post #143

I just run a local microVM. I built a small CLI that wraps lima to make my life easier. With a few commands I have a VM running locally with all batteries included (CC/Codex, ssh, packages I need, ...). With this I'm not saying Deno or Docker sandboxes are useless.

Just wrapped up my own module for this. Remixed my worktree workflow with a lima wrapper. I wanted to go head first to giving Claude Code full autonomy but realized capability and prevention need to go hand in hand

Next step for me is creating a secrets proxy like credit card numbers are tokenized to remove risk of exfiltrating credentials.

Edit: It’s nice that Deno Sandbox already does this. Will check it out.

Re: Deno Sandbox

#147

Post by saghm »

booi wrote: post #80
ptx wrote: post #78

Earlier quoted context omitted.

Yes... but... Presumably the proxy replaces any occurrence of the placeholder with the real key, without knowing anything about the context in which the key is used, right? Because if it knew that the key was to be used for e.g. HTTP basic auth, it could just be added by the proxy without using a placeholder. So all the attacker would have to do then is find and endpoint (on one of the approved hosts, granted) that e…

Where would this happen? I have never seen an API reflect a secret back but I guess it's possible? perhaps some sort of token creation endpoint?

The point is that without semantic knowledge, there's no way of knowing whether the API actually considers it a secret. If you're using the Github API and have it listed as an approved host but the sandbox doesn't predefine which fields are valid or not to include the token, a malicious application could put the placeholder in the body of an API request making a public gist or something, which then gets replaced with the actual secret. In order to avoid this, the sandbox would need some way of enforcing which fields in the API itself are safe. For a widely used API like Github, this might be something built-in, but to support arbitrary APIs people might want to use, there would probably have to be some way of configuring the list of fields that are considered safe manually.

From various other comments in this thread though, it sounds like this is already well-established territory that past tools have explored. It's not super clear to me how much of this is actually implemented for Deno Sandboxes or not though, but I'd hope they took into account the prior art that seems to have already come up with techniques for handling very similar issues.

Re: Deno Sandbox

#148

Post by dizhn »

ushakov wrote: post #57
echelon wrote: post #47

Earlier quoted context omitted.

Everyone wants to lock you in. Unfortunately there's no other way to make money. If you're 100% liberally licensed, you just get copied. AWS/GCP clone your product, offer the same offering, and they take all the money. It sucks that there isn't a middle ground. I don't want to have to build castles in another person's sandbox. I'd trust it if they gave me the keys to do the same. I know I don't have time to do that,…

we have 100% open-source Sandboxes at E2B git: https://github.com/e2b-dev/infra wiki: https://deepwiki.com/e2b-dev/infra

This is exactly what i am building for a friend in a semi amateur fashion with LLMs. Looking at your codebase I would probably end up with something very similar in 6 months. You even have an Air toml and use firecracker, not to mention using go. Great minds think alike I suppose :D. Mine is not for AI but for running unvetted data science scripts. Simple stuff mostly. I am using rootless podman (I think you are using docker? or perhaps packer which is a tool i didn't know about until now.) to create the microvm images and the images have no network access. We're creating a .ext4 disk image to bring in the data/script.

I think I might just "take" this if the resource requirements are not too demanding. Thanks for sharing. Do you have docs for deploying on bare metal?

Re: Deno Sandbox

#149

Post by twoodfin »

bonsai_spool wrote: post #55
zamadatix wrote: post #14

Earlier quoted context omitted.

Is there a chance you could ask Ryan if he had an LLM write/rewrite large parts of this blog post? I don't mind at all if he did or didn't in itself, it's a good and informative post, but I strongly assumed the same while reading the article and if it's truly not LLM writing then it would serve as a super useful indicator about how often I'm wrongly making that assumption.

There are multiple signs of LLM-speak: > Over the past year, we’ve seen a shift in what Deno Deploy customers are building: platforms where users generate code with LLMs and that code runs immediately without review This isn't a canonical use of a colon (and the dependent clause isn't even grammatical)! > This isn’t the traditional “run untrusted plugins” problem. It’s deeper: LLM-generated code, calling external API…

Great list. Another tell is pervasive use of second-person perspective: “We’ve all been there.” “Now you have what you need.”

As you say, this is cargo cult rhetorical style. No purpose other than to look purposeful.

Re: Deno Sandbox

#150

Post by Latty »

signal11 wrote: post #141
twosdai wrote: post #6

Earlier quoted context omitted.

Like the emdash, whenever I read: "this isn't x it's y" my dumb monkey brain goes "THATS AI" regardless if it's true or not.

I’ve been using em-dashes since high school — publishing the school paper and everything. I remain slightly bemused by people discovering em-dashes for the first time thanks to LLMs. Also, “em-dashes are something only LLMs use” comes perilously close to “huh, proper grammar, must’ve run this by a grammar checker”.

I started using them when I discovered the compose key and it became easy to type them, but I've genuinely considered stopping using for this reason.
Post reply on HN