Skip to content

Comment on An unexpected Redis sandbox escape affecting Debian-based distrosparent

Comments

Given that lua is meant to be an embedded language, its kind of surprising this is neccesary.

Making an application scriptable doesn't always mean you want it to be scriptable by hostile adversaries.

That's what i mean. For an embedded scriptable language, making something scriptable and sandboxed is a core use case. It is surprising to me that doing the thing lua is famous for requires source code mods.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.