Hacker News Reader

I have been thinking about this myself, but am still not convinced about how to run untrusted Python code. I'm not convinced that the right solution is to run the code as WebASM [1].

I have been looking towards some kind of quick-start qemu option as a possibility, but the project will take a while.

[1] https://github.com/mavdol/capsule

View on HN

I see what you mean, but i think there is room for both approaches.

If we want to isolate untrusted code at a very fine-grained level (like just a specific function), VMs can feel a bit heavy due to the overhead, complexity etc

What you really want to do is decouple the sandbox specification annotations from the sandbox implementation backend, yes?

What's the problem with WASM? It's a mature target, and was created primarily, if not solely, for running untrusted native code.

Reply on news.ycombinator.com