←back to thread

798 points bertman | 1 comments | | HN request time: 0s | source
Show context
djoldman ◴[] No.45899558[source]
From

https://github.com/yt-dlp/yt-dlp/wiki/EJS

it looks like deno is recommended for these reasons:

> Notes

> * Code is run with restricted permissions (e.g, no file system or network access)

> * Supports downloading EJS script dependencies from npm (--remote-components ejs:npm).

replies(2): >>45900422 #>>45900960 #
arbll ◴[] No.45900422[source]
It's fine for this project since google is probably not in the business of triggering exploits in yt-dlp users but please do not use deno sandboxing as a your main security measure to execute untrusted code. Runtime-level sandboxing is always very weak. Relying on OS-level sandboxing or VMs (firecracker & co) is the right way for this.
replies(3): >>45900665 #>>45903690 #>>45907042 #
1. jrochkind1 ◴[] No.45900665[source]
i wonder if it would be legal if they did, as an anti-circumvention counter-measure.