Bubblewrap and traditional sandboxing stuff doesn't support custom containers or anything that would be a feasible stand-in for them gVisor works great, except that it has awful compatibility which is a big issue when users submit their own interpreters Nabla is similar Kata doesn't play nice with Docker and I'm not even going to attempt Kubernetes, it's totally overkill Firecracker is too much work and my hardware doesn't support it
E.g., with TIO/ATO, you can trust the compiler. You don't really need to sandbox it, and if you do, you can do it separately from running the code. You can just adapt it to the language. A custom thing would need to be one-size-fits-all
One possible "solution" is to just run unsecured docker in a VM, and periodically wipe it, that still allows crypto mining and stuff, but at least it secures the host machine
Issue is that once you can break out of docker the first time, you can set up a script to do it seconds after every wipe
And you can also frick with people's code or DoS everything
And with such old CPUs, we get back to the technological limitations side of thing
And the cheaper droplets don't have virtualization support, so no backup if my main server goes down
I do think there's potential in the bubblewrap side of things
Moving away from the container based stuff to a slightly more limited setup could work. It's just going to take a lot of work and research and I don't really have the motivation to do that.
I don't understand why spawing a new VM (might not be the right thing) and killing it after 60 seconds doesn't work.
I can't wrap my head around the escaping docker bit.
You're saying TIO/ATO use pre-existing images which are guaranteed to be safe, and we'd have to make custom ones?
Even if they do escape though, doesn't a new VM still give you that safety net and totally shut down after 60 seconds if you tell it to?
Don't Kubernetes style things take care of that? Or couldn't they be spawned in VM, within a user that had restricted read-only permissions? Whereas within the Docker they could write files and everything. But escaping out of it wouldn't allow much.
I was working on a thing like that for a while, too.
@AviFS Yes we have to approve them individually, but we'll just approve everything from CGCC.
DO Droplets won't scale automatically or anything scary involving extra money, from what I understand. So the worst thing that happens is the server crashes and has to be restarted.
There's should be any bills involved, even in the worst case. So a CGCC prank is just a CGCC prank, and will be found, appreciated, and removed reasonably quickly.
I don't think we should kill the project only because we can't make the security tight enough to open it up to the world. But if you don't want to work on it, that's a totally different thing of course!
> Vladimir Putin has assumed, without a drop of exaggeration, a historic responsibility by deciding not to leave the solution of the Ukrainian question to future generations.
everyone my russian professor has talked to from back home about it either is against the invasion or just sort of passively goes with whatever the news is telling them (most of the faculty in the department are ukrainian afaik but she is actually from moscow)
How long should I leave a question in the sandbox?
In general you should leave a question at least 72 hours to ensure that the people who check it fairly regularly will have a chance to see it and comment.
@DialFrost i mean some other challenges ive seen before allowed trailing whitespaces in the output, but im not sure about ascii art challenges specifically
Given \$ i = \sqrt{-1} \$, a base-\$ (i - 1) \$ binary number \$ N \$ with \$ n \$ binary digits from \$ d_{0} \$ to \$ d_{n - 1} \$ satisfies the following equation.
$$ N = d_{n - 1} (i - 1) ^ {n - 1} + d_{n - 2} (i - 1) ^ {n - 2} + \cdots + d_{1} (i - 1) + d_{0} $$
For example, a decimal number...
I have an idea: A raspberry pi or some cheap computer thingy with low power consumption, which will, in the morning, automatically fetch things like news and the contents of my CGCC inbox and read it aloud (with a cheap speaker or something)
Since I usually just fall back asleep after my alarm goes off, because I'm too bored to stay awake but too lazy to get out of bed
This seems like it would be a really cool project...if I could actually get my hands on one. Even the micro usb power cables for these things are out of stock :(
Python 3, 376 bytes
Basically a golfed version of the reference solution @DLosc gave
import re
k=" "
def p(e,*t,l=0):
for n in e:
if")"==n:break
if")">n:z=p(e);l=max(l,z[0]+1);t+=z,
else:l=max(l,1);t+=n,
return[l,*t]
t=p(iter(re.findall("[^() ]+|\S",input())[1:]))
def f(t,d=k):
if[*t]==t...
@mathcat is the other function an action? maybe you wanted something like this: desmos.com/calculator/lb5izktaac, though im not too sure this is exactly what you want. maybe if you elaborate a little more i can help you better
always hate it when my chem class has another cool experiment, but we have to actually jot down observations and explanations for every single thing that happens in the reaction. its like being forced to take notes and analyze a movie while watching it for the first time, especially when you actually enjoy said movie
How long should I leave a question in the sandbox?
In general you should leave a question at least 72 hours to ensure that the people who check it fairly regularly will have a chance to see it and comment.
Python 3, 376 bytes
Basically a golfed version of the reference solution @DLosc gave
import re
k=" "
def p(e,*t,l=0):
for n in e:
if")"==n:break
if")">n:z=p(e);l=max(l,z[0]+1);t+=z,
else:l=max(l,1);t+=n,
return[l,*t]
t=p(iter(re.findall("[^() ]+|\S",input())[1:]))
def f(t,d=k):
if[*t]==t...
