Hacker News Reader

Comment by jacquesm | Hacker News Reader

I'm categorically against shelling out for anything from a web based service. If you need this sort of functionality implement a queue, send a signal using some IPC process and wait until the job is done.

Exec'ing anything (even Postscript, which is after all a full fledged programming language) is a huge risk. Ensure that the input you receive is not malicious and if you can recompile any executables that will process hostile inputs to process only the subset of commands and functions that you think should be able to deal with untrusted input.

And of course you still have to properly sandbox those programs.

View on HN

> Ensure that the input you receive is not malicious

To do that input needs to be decidable. Input from possibly-malicious sources needs to be limited to a grammar no more complex than deterministic context-free[1]. Accepting Turing complete input introduces the possibility that recognizing anything about the input might be provably undecidable.

[1] https://archive.org/details/The_Science_of_Insecurity_

There is another mathematically-correct layer of security you can get, though, which is the IO interface to the real world that you provide the input. Barring (huge!) bugs in the (very simple!) interpreter, it doesn't matter how much basic brainfuck [1] from a user you execute, they aren't going to get a shell. Worst they can do is burn CPU until you shut them down. (Brainfuck interpreters are already generally pretty tightly RAM limited.)

Sandboxing is of course easier said than done, but it's still mathematically valid. The problem is that our real hardware has too many metaphorical sharp edges from a mathematical point of view, not that it doesn't work.

[1]: https://esolangs.org/wiki/Brainfuck

Two other important points:

1. Those command line programs weren't necessarily designed with an adversarial user in mind! Sanitizing input to prevent shell escape sequences is not enough. You really need to sandbox well.

2. For some tasks, it might be easy for a malicious user to guess which command-line tool you are using. You might be getting way less depth out of obscurity than you think you are.

That's one very important reason why you want that queue. That way you at least break the most obvious path to return output.

Reply on news.ycombinator.com