Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <1359906287.12133.41.camel@devil>
Subject: Re: Branch to switch from SpiderMonkey to Node.js
From: Klaus Trainer <klaus_trainer@posteo.de>
To: dev@couchdb.apache.org
Date: Sun, 03 Feb 2013 16:44:47 +0100
In-Reply-To: 
 <CAN-3CB+8nZUNaLYi06d4-O0A4AzdYZAnaF_g5g2KXsDX-yNcAw@mail.gmail.com>
References: 
	<CAN-3CBK3Pq3=kTy82T4LR3Fr27k_u-=QFSo2VRwKHnw4fC-eTg@mail.gmail.com>
	 <CAKmKYaCUgd+oxyjP4BcOXz94_2OJOB6du_1hF-nS30EtMGaY0A@mail.gmail.com>
	 <CAN-3CBLtSwGSQ8JxMGjFSfAtGOWtr1gjJdvdVRYcsDg3a2-ogw@mail.gmail.com>
	 <5102B439.10500@lymegreen.co.uk>
	 <CAN-3CBK+yWV0oQX7f1Hsj0XpORvrjpJ7dmEhn4bpHLryKDVmAw@mail.gmail.com>
	 <CAFUSCh_knsU-yg-bBu0v8Labq11tYJfcTB1VLrGvFNJkE4YpLQ@mail.gmail.com>
	 <CAN-3CBLS_iQJB=n7VVHJ288OOu+5JO-6oJwR=760KmwKE9huQQ@mail.gmail.com>
	 <CAFUSCh9zoCvJU638s7n72+oAmJMSzmM9+oett-=Hiccx-hwjhw@mail.gmail.com>
	 <CAN-3CBKMdDK7uv4-pKJn5ziPU=my23jXA6S0SQNAP+Jw2bHsow@mail.gmail.com>
	 <CAJNb-9oVW9AfngCmd7bJjU34pqsouxYtScAhqCB5p0zUXh6obw@mail.gmail.com>
	 <CAJ_m3YCDEtQ8HKSZ8q1uCBaP5Gg08pUxv+4-kX_+xQfjPgt3Hw@mail.gmail.com>
	 <CAL+Y1nsoN-voZBexDVO3_xNAdy318uyazXsLyezB2U9vbvv-fQ@mail.gmail.com>
	 <CAN-3CBLhsi2hG1XXOFgZNXYq+1Nm8Rb7Gsvq=tmTPaLYO_2r4g@mail.gmail.com>
	 <CAAL6JQjUY9C9K7RfjVYJm-kGwNXq4vWEPJti2_bho_FPA9ukTg@mail.gmail.com>
	 <CAJ_m3YBaM7wCG=EOcZDk7Mx2gw0dhNdsOoM0oCnKf2Tf_czjrw@mail.gmail.com>
	 <CAN-3CBJgfE1CF4sK_dQWS1sQQNiKyecgSpwViOQZfHSvdOcczw@mail.gmail.com>
	 <CAAL6JQizwBioFWo6hfyVdFrBwr5vdGuHjNToHSdCFvb9Sq05iw@mail.gmail.com>
	 <CAN-3CB+8nZUNaLYi06d4-O0A4AzdYZAnaF_g5g2KXsDX-yNcAw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

On Thu, 2013-01-31 at 14:46 +0000, Jason Smith wrote:
> 
> The word "sandbox" is vague. There is no clear definition. (There is a
> mundane historical reason for that: the "sandbox" was whatever the C
> program did.)

Good point. For instance, even if you're executing JavaScript within
plain Spidermonkeys, people might still be able to issue
denial-of-service attacks against your system. Or side channel attacks.

Earlier in this thread, I wrote a response to your email from Thu, 31
Jan 2013 16:54:45 +0000, where I put a list of "Seven Degrees of
Sandboxing" and try to help finding a good approximation for what the
notion of "sandbox" will mean to us. I just realized that it might have
been a better fit to put it here.

> Prediction: as quickly as we identify sandbox features, somebody can build
> a Node.js implementation to reasonable satisfaction. But we'll see.

Yeah.