It's Like Déjà Vu All Over Again
"You could probably waste an entire day on the preceding links alone. But why take chances? We also give you Paul Snively..." — John Wiseman, lemonodor
Running untrusted code. Olegs recommended this newsgroup posting, which lucidly explains the issues of running untrusted code. I agree that this has a great deal to do with programming languages. Indeed, we mentioned some of the theory concerned in the past (e.g., PCC). [Lambda the Ultimate]
A sandbox is a good idea. But do problems occur when the system has not been designed for sandboxes from the bottom up? I should be able to take some code and run it in a VM that is completely trusted. Full CPU, full filesystem, full reflection, etc. Then I should be able to take that same code and run it in a more restricted VM: the "CPU" is governed, the filesystem is restricted or even in-memory for read/write, reflection cannot access or change sensitive information.
Are there problems with sandboxes in general, or with retrofitted implementations? Applying a sandbox to some code is just another kind of lambda. I haven't read about this yet, but will get to it.
Ah, Patrick, so you're about to discover Capability Security. Excellent. The short answer to the question "can I run untrusted code" is "yes," and the surprising thing is that this answer has been known for around 30 years!
Your intuition that you're going to need "sandboxing" to be pervasive is correct. There are some other qualifications as well, such as the need for an abstract store with unforgeable references, lexical scoping, and first-class functions. If you want this security to work in a distributed fashion, you need some interesting crypto protocols on the wire.
The best place to learn about this at the language level is at the E project. The best place to learn about it at the OS level is at the EROS project.
The bottom line is that in an era when every new e-mail trojan horse/virus/worm is worse than the one before, we desperately need people to take this material seriously, learn it, understand it, and implement it. Otherwise people will demand that we revert the Internet to a balkanized set of barely-connected islands to avoid these attacks.
Finally, it's important to note that Capability Security is the only way to perform certain important functions, such as implementing Smart Contracts, across trust boundaries on the Internet.
10:20:05 AM
