Hacker News Reader

> In other words, if you publish a gem on RubyGems.org, you can execute arbitrary code on RubyDoc.info.

Shades of the build.rs problem. We really need sandboxed builds in every language ecosystem at this point.

The sandbox was already there, Rubydoc runs yard inside docker, the problem is that container still has network access

Presumably the docker container has network access because something else in the build system requires it? I don't think sandboxing the entire build process is the right level of granularity here - one ideally wants to be able sandbox each package's build scripts individually.

So, not a sandbox then.

Reply on news.ycombinator.com