Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1283)
Subject: Re: Elixir Sandbox
From: Filippo Fadda <filippo.fadda@programmazione.it>
In-Reply-To: 
 <CAHdjip+=6KyxcRNtvUY5ZiRnsbTi9SaTKJmjWqSBg1xosU6c6w@mail.gmail.com>
Date: Wed, 16 Oct 2013 23:43:38 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <CE36AD4A-BB43-47F0-A78A-B4C80307C996@programmazione.it>
References: <980F839E3DB1465287B1FFE3FF665DEB@chriskeele.com>
 <CAJ_m3YCH_1+3EqZnBVCo1sN8Vffuh1JhgCgkLW=4SsXL1Uiqiw@mail.gmail.com>
 <B24D1215-ED30-4720-9523-0B6E40352EEA@apache.org>
 <878ABCFE-A3E9-4FA8-84F7-C58729570834@programmazione.it>
 <CAHdjip+=6KyxcRNtvUY5ZiRnsbTi9SaTKJmjWqSBg1xosU6c6w@mail.gmail.com>
To: dev@couchdb.apache.org

Sandboxing is useful when you are running applications, in a defined =
environment (like an OS), you can't trust, not libraries, but =
applications.  For example in iOS all the apps are sandboxed, not the =
system libraries. But no one can't run an application inside CouchDB if =
CouchDB can't be accessed from outside. You can't do the equivalent of =
SQL injection in CouchDB using CouchDB as simple DBMS. An user can't =
insert a ddoc in it if you can connect to CouchDB just from the =
localhost and you don't know the admin's username and pass.
The only person able to write ddocs is the application developer, and =
I'm pretty sure he won't delete the root directory in a map function. =
When used as a pure database, CouchDB is not an environment, it's a =
database, something to store documents, using a client. CouchDB used to =
run Couch apps instead is an environment, it acts like an OS in which =
the applications run. In this case, maybe, you need a sandbox.
I mean, the only needs I see for sandboxing here is when you have a =
company selling CouchDB as a service, and running any kind of third part =
applications, or as I said, when you are using CouchDB as the =
environment in which the couch apps run.
I'm not saying sandboxing is useless, I'm saying is something optional a =
sys admin should enable in case of need.

-Filippo

On Oct 16, 2013, at 11:03 PM, Alexander Shorin wrote:

> Because you are running your code and you trust yourself (I hope so).
> Another user may not trust you or your code, so he have to inspect
> every bit of your code to make sure that it wouldn't make a big
> security hole in his server. Having sandboxing feature guarantees him
> that he may run third party code with no worries about.
>=20
> --
> ,,,^..^,,,