Hacker News Reader

The real dependency problem is that most languages give out way too much trust by default. Any code can have any side effects.

I'd like ways to guarantee my dependencies have no side effects, like they were Haskell with no IO/unsafePerformIo, or to aggressively audit and limit those side effects. Malicious event stream package suddenly wants to use the network? No.

View on HN

Another way to state this is: accept the state of the world and approach the problem using an existing methodology - treat code as untrusted and whitelist execution paths. SElinux and others do this, intrinsic is another product that uses the same approach for app runtime, I think this is probably the future of this problem space.

This is zero trust, and this pattern is showing up everywhere (again?).

Reply on news.ycombinator.com