This looks so cool!!! Can't wait to try it out!
Scastie: use any Scala compiler and Scala library in the browser
21–30 of 34 posts
Re: Scastie: use any Scala compiler and Scala library in the browser
#22(naturally, the very first thing I tried to evaluate is scala.io.Source.fromFile("/etc/passwd").getLines.mkString("\n") . Spoiler alert: it works!)
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
Congrats Guillaume! How much of ScalaKata code is in there? Sorry if I missed it in the post, but is Scastie open source? I'd love to finally fix scalatutorials.com :)
p.s. did you guys consider using a "serverless" architecture to isolate runners instead of docker? Also, are you running it with java -Djava.security.manager? If not then why?
Re: Scastie: use any Scala compiler and Scala library in the browser
#23Earlier quoted context omitted.
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
Congrats Guillaume! How much of ScalaKata code is in there? Sorry if I missed it in the post, but is Scastie open source? I'd love to finally fix scalatutorials.com :) p.s. did you guys consider using a "serverless" architecture to isolate runners instead of docker? Also, are you running it with java -Djava.security.manager? If not then why?
The security manager can be disabled using reflection. If you don't allow you loose some libraries like Akka. The main thing that is missing from ScalaKata is autocompletion and it will be implemented in the summer during the GSOC. AWS lambda could be worth investigating. We don't expose an API for evaluating but others have expressed this need. Can you create an issue on GitHub for that?
Re: Scastie: use any Scala compiler and Scala library in the browser
#24Earlier quoted context omitted.
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
I put together a list of security tips: https://github.com/wsargent/docker-cheat-sheet#security-tips Probably the biggest one is to use Virtualbox or another virtual machine so that Docker isn't your only line of defence.
> I put together a list of security tips: [...]
and 63 contributors. ;p
Re: Scastie: use any Scala compiler and Scala library in the browser
#25Earlier quoted context omitted.
I put together a list of security tips: https://github.com/wsargent/docker-cheat-sheet#security-tips Probably the biggest one is to use Virtualbox or another virtual machine so that Docker isn't your only line of defence.
> I put together a list of security tips: [...] and 63 contributors. ;p
Check the blame log. That section's all me.
Re: Scastie: use any Scala compiler and Scala library in the browser
#26Earlier quoted context omitted.
It does and you are root. You are evaluating inside a docker container. It's not a bulletproof method but it will stop a few. The instances evaluating your code is also on a network not accessible from the internet. I'm not an expert in security, if you have any advice on how we can improve our defence please tell us.
I am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload). My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access i…
I agree with this. What's to stop me from opening a bunch of the containers and using them to DDOS someone or to send out spam emails? I'm already playing around with system commands and they seem to be entirely unrestricted.
Basically I can run any bash script, as is, with
import sys.process._
"BASH_COMMAND" !!
Re: Scastie: use any Scala compiler and Scala library in the browser
#27Will this allow running a play app? (with debug etc) ??
Re: Scastie: use any Scala compiler and Scala library in the browser
#28Earlier quoted context omitted.
Congrats Guillaume! How much of ScalaKata code is in there? Sorry if I missed it in the post, but is Scastie open source? I'd love to finally fix scalatutorials.com :) p.s. did you guys consider using a "serverless" architecture to isolate runners instead of docker? Also, are you running it with java -Djava.security.manager? If not then why?
The security manager can be disabled using reflection. If you don't allow you loose some libraries like Akka. The main thing that is missing from ScalaKata is autocompletion and it will be implemented in the summer during the GSOC. AWS lambda could be worth investigating. We don't expose an API for evaluating but others have expressed this need. Can you create an issue on GitHub for that?
Gladly, sorry for the silly question, but on which repo? Scala Lang main website? Scalakata?
Re: Scastie: use any Scala compiler and Scala library in the browser
#29Earlier quoted context omitted.
The security manager can be disabled using reflection. If you don't allow you loose some libraries like Akka. The main thing that is missing from ScalaKata is autocompletion and it will be implemented in the summer during the GSOC. AWS lambda could be worth investigating. We don't expose an API for evaluating but others have expressed this need. Can you create an issue on GitHub for that?
Gladly, sorry for the silly question, but on which repo? Scala Lang main website? Scalakata?
This is the main repo: https://github.com/scalacenter/scastie. It's not at silly question at all.
Re: Scastie: use any Scala compiler and Scala library in the browser
#30Will this allow running a play app? (with debug etc) ??
Yes it can run anything sbt can.
https://scastie.scala-lang.org/MasseGuillaume/62vmEr9XR0qDWw...