SafeScript is a restricted JavaScript language for running untrusted code inside applications. It aims to offer more flexibility than data-only formats such as JSON without exposing the host environment to arbitrary JavaScript. Scripts are function bodies that return results, and the compiler produces ordinary JavaScript or PHP. With no capabilities supplied, code can perform isolated computations using a curated set of safe built-ins; it cannot access I/O or the surrounding environment.
A .safe file can declare its language version, required and optional capabilities, expected environment, and methods it intends to call on returned types. Hosts can inspect those declarations, check that requirements are available, and validate type-method declarations before execution. Each file is intended to be a separate trust boundary: it has no imports, and the host decides what implementations to provide. SafeScript restricts the accepted syntax, blocks access to dangerous prototype properties, shadows native globals, and exposes limited frozen facades for common built-ins. Compiled checks limit execution time and operations, while hooks let hosts monitor calls to injected functions. Type declarations support preflight validation but do not themselves enforce runtime behavior. The design puts capability decisions in the host’s hands and avoids making scripts depend on package managers.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A covert Russian network used fake media posts to exploit French riots, spreading false claims about migrants and portraying the government as weak. French and EU assessments also found Israeli-linked and MAGA accounts pushing hostile narratives about the unrest. (reuters.com)
A Microsoft-signed boot shim can be reused to undermine Secure Boot protections on corporate computers. The research explains how Secure Boot validates trusted boot components and previews a practical technique for exploiting that trust. (leosmith.wtf)
ChatGPT Desktop forwards your local SSH agent to remote machines. Remote agents can use your SSH credentials to access private repositories and push code. (news.ycombinator.com)
Chinese surveillance technology is helping repressive African governments monitor citizens and suppress dissent. The systems give authorities tools to track critics and control public activity. (economist.com)
U.S. officials say Alice Huang, a Chinese businesswoman close to Nvidia CEO Jensen Huang, was recruited by China’s Ministry of State Security to gather intelligence on him and seek access to advanced AI chips. House committee leaders have requested a closed-door briefing from Jensen Huang about his interactions with her. (nytimes.com)
Security researchers found vulnerabilities in a major automaker’s connected-car systems while examining the infrastructure behind its remote-unlock app. An exposed admin tool and weaknesses in the platform enabled access to cars across much of the world. (shubs.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.