[racket] planet security

Yeah, thanks, I'll try it.

2011/1/27 Robby Findler <robby at eecs.northwestern.edu>:
> Sure. See the sandbox library. You can create a sandbox and then
> require the library there. Of course, there is an interoperability
> problem to be solved if you actually want to manipulate the filesystem
> (say) and use an untrusted planet library.
>
> Robby
>
> On Thu, Jan 27, 2011 at 12:45 PM, Nikita B. Zuev <nikitazu at gmail.com> wrote:
>> If I understand correctly when we require a module from the planet, it
>> gets downloaded to racket home directory, compiled and required.
>> Racket's require is not just about getting definitions, it also
>> evaluates code inside required module.
>>
>> So in theory a malicious person can make a planet package that provide
>> something useful and also behind the scenes evaluates something like:
>> (system "sudo rm -rf /")
>>
>> I prefer to think that there are no such people using racket, but with
>> it's (racket's) growing popularity this can become the case. Recent
>> events with planet made me more cautious.
>>
>> I wonder if there is a way to create something like `safe-require'
>> using racket sandboxes, that will allow to require modules in context
>> where they can not perform any `unsafe' IO, access network,
>> filesystem, shell etc?
>>
>>
>> --
>> Regards,
>> Nikita B. Zuev
>> _________________________________________________
>>  For list-related administrative tasks:
>>  http://lists.racket-lang.org/listinfo/users
>>
>



-- 
Regards,
Nikita B. Zuev