HN

Comments (39)

• cadamsdotcom
  Re the first point: stdio only offers one way to interact with users. stdio is what pulls naive designers into this trap - untrusted output sharing a channel with trusted decision input.Deno should disallow arbitrary output on stdout/stderr. Even prefixing the lines won't work because control characters like ^H are sent in-band and can delete the prefix.The "in-band vs. out-of-band" is nothing new. Worth looking up 2600hz, the signaling frequency of the US phone system way back when. Pick up a handset, generate a 2600hz tone. Suddenly you're talking to the call routing system. Only a few steps from there to free phone calling anywhere in the world. Call routing signaling should've been separate, out of band - but given the tech at the time they'd have needed extra wires for signal lines ($$$) so the tradeoff was made, risk accepted.The phone system designers went for in-band signaling to save money. Deno doesn't need to save money by running less copper so my money's on naïveté. Which doesn't bode well.And the rest of the points made.. well yep the author is on point - made worse by Deno developers publicly defending their wrong choices.Thankfully there're great alternatives.
• Menu

  jFriedensreich
  I was a fan of deno because at least they tried, its not that there was an alternative runtime that tries to do permissions right or that there is an operating system tool that allows async(!) permissions with user interaction. We really need a simple to use "productised" but true open source solution that allows halting any software and evaluating policies for run, fs and network etc and can reason on process and context level.
• Menu

  hoppp
  Deno has 1 year of official support left...I liked the security model because at least they had something, unlike node.
• Menu

  phyzome
  I actually have a terminal program that needs to ask for sensitive inputs from the user sometimes, potentially after attacker data has been printed. I've been trying to figure out how I should handle that!My plan was to encode to Unicode (lossily), strip out control characters, and add some visual framing. Anything else I should be considering? Is there a standard approach? Haven't actually done the research on this yet, but since it came up here, I figure someone might know.(This is https://codeberg.org/timmc/breakmancer if anyone is interested.)
• kevin_thibedeau
  > the permission prompt is “partially visible” (you can see an emoji)Terminals can be configured to render emoji in text presentation form where they become monochrome glyphs that can be colored like ordinary text with escape sequences. Not something to hinge your security model on.
• bluegatty
  Isn't this a general TUI kind of problem, endemic to all CLI? What does this have to do with Deno specifically?
• hackerbrother
  It was a neat idea but they didn't take it far enough. It would have been neat if you could restrict dependencies from network/FS access, but they didn't make it that granular.I was a fan of Deno from the beginning, but not targeting NodeJS compatibility at the beginning turned out to be the wrong move. Now Bun gets to be Anthropic's testbed for the future of software development. (Which includes the wholesale plagiarism and optimization of Oxc into its codebase, wowza.)Side note: `deno fmt` is a great Markdown formatter. I might get around to extracting out just that part of it.
• yoyohello13
  Lucky for them. Deno is dead.
• ximm
  And as far as I can tell, this is the exact same security model that is now used by OpenCode and similar
• proxyscore
  Deno is a dead man walking, they cashed out being useful to CF and other than that, they tried parity with nodejs, which was naive, I am not going to redo my backend just for that.
• two_handfuls
  Very well written, and excellent points! Thank you.
• genxy
  I'm not a fan of opinions in titles. (there I did it)It is self-centered and narcissistic. Why? WTFRU. An opinion isn't an argument. You have to have reasons beyond your opinions and those are what matter. Lead with those, and your opinion is implied by the fact you are talking about it.Deno's Security Model is a False Sense of SecurityDeno's Permissions Are Not a SandboxThe Illusion of Deno's "Secure by Default" ModelWhy --allow-run and Permission Prompts Don't Make Deno SafeThe title weakens an otherwise pretty good article.