Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added settings to disable sandboxing #430

Closed
wants to merge 4 commits into from

Conversation

Kilobyte22
Copy link
Member

Now people (who are careful) can disable the sandbox to access the real server lua side.

@fnuecke
Copy link
Member

fnuecke commented Jul 24, 2014

All right, after some sleep and thinking this over, I believe this would be better kept as a fork of OC. Aside from it feeling like unnecessary... attack surface, here's some hopefully more objective reasons, ordered decreasingly by how strongly I feel about them:

  • The target audience that would make use of this / be able to make use of this is very limited.
  • Even with warnings all over the place, this adds more ways for people to unwittingly open themselves to attacks. I'd even consider removing the bytecode setting and only keep it in the fork.
  • For most use-cases it shouldn't be too hard to write a small addon-card that serves as a wrapper for native functionality.
  • As discussed on IRC, with the current libs the main use - loading native libraries - seems to not work, anyway, and I'd like to avoid re-compiling the library on every platform again.
  • Even if it's a fork, as long as the versions match (i.e. it is kept up-to-date with the master) it'd be compatible with normal OC (unless the fingerprint interferes with that? would have to check, and potentially remove that from 1.7, too).
  • Some may try to use this as a stepping stone for unnecessary drama.

After taking into account all interaction between these points my cost-benefit guesstimate leads me to where I stand. As mentioned earlier, I'd be willing to provide a job on Jenkins, though.

@fnuecke fnuecke closed this Jul 24, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants