[{"data":1,"prerenderedAt":267},["ShallowReactive",2],{"project-18792164":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":42,"post_text":43,"what":44,"said":80,"maker_in_thread":184,"shape":192,"grid":195,"attempts":231,"same_week":232,"maker_shows":39,"maker_hidden":259,"reader_version":260,"card":261},"18792164","Avenv","A more isolated virtualenv","title","Show HN: Avenv – A more isolated virtualenv","https:\u002F\u002Fgithub.com\u002Fihucos\u002Favenv","github.com","ihucos",1546215821,2018,20,18,1193,2155,56,"shown","dev_tools","virtual environment","cli",[24,25,26,27],"virtualenv","chroot","isolation","python environment","roasted",-0.533,{"positive":31,"neutral":32,"mixed":32,"critical":33},0,1,8,10,{"execution":36,"privacy":38,"idea":40,"docs":41},{"positive":31,"critical":37},4,{"positive":31,"critical":39},3,{"positive":31,"critical":31},{"positive":31,"critical":31},[32,31,31,31,31,32,31,32,39,31,32,32,39,31,32,31,32,32],null,{"problem":45,"audience":43,"pricing":43,"motivation":43,"time_to_build":43,"stack":55,"openness":77,"stage":78,"team_size":79},{"value":46,"source":47,"evidence":48},"Python virtualenv does not isolate the environment deeply enough, so it is extended with a chroot.","inferred",[49,51],{"id":50},"post",{"id":52,"by":53,"text":54},"18794106","fiatjaf","I'll not use this, because I've had enough of Python and will do my best to not start any new Python programs (also I don't know how is this better than virtualenv), but the…",[56,63,67],{"value":57,"source":58,"evidence":59},"shell script","maker",[60],{"id":61,"by":11,"text":62},"18794451","neither avenv nor bchroot (nor chroot by the way) claim any security gain. Bugs are in this case just bugs and I'll fix them. bchroot is ~ 200 lines C, avenv is 60 lines shell…",{"value":64,"source":58,"evidence":65},"C (bchroot)",[66],{"id":61,"by":11,"text":62},{"value":68,"source":58,"evidence":69},"xbps (Void Linux package manager)",[70,74],{"id":71,"by":72,"text":73},"18793054","pietroglyph","It uses xbps! ``` $ venv\u002Fbin\u002Fxbps-install -Sy libreoffice xorg-fonts # you can imagine that as kind of like a chrooted void linux ``` I wonder how easy this is to do with other…",{"id":75,"by":11,"text":76},"18794062","This also works with others package managers\u002Fdistributions. Only with apt\u002Fapt-get you need some extra configuration \"APT::Sandbox::User=root\" I was thinking about using Ubuntu,…","open_source","prototype","unknown",{"praise":81,"objections":94,"requests":135,"questions":160,"alternatives":175},[82,87],{"value":83,"source":84,"evidence":85},"README is well written","commenter",[86],{"id":52,"by":53,"text":54},{"value":88,"source":84,"evidence":89},"Not awful as a first chroot manager attempt",[90],{"id":91,"by":92,"text":93},"18792736","shakna","I'd like to say good things, but there are a few big issues first. It goes to the effort of downloading the sha256 hashes... For a filename. It never actually confirms a download…",[95,111,117,124,128],{"value":96,"source":84,"evidence":97},"Binary artifacts committed to git and downloads lack hash verification",[98,99,103,107],{"id":91,"by":92,"text":93},{"id":100,"by":101,"text":102},"18792740","mdaniel","Please don't put binary artifacts in git; GitHub offers \"releases,\" which are essentially download buckets attached to git tags, from which one can download tars. To the best of…",{"id":104,"by":105,"text":106},"18792587","sedeki","Seems a bit scary to install it like that",{"id":108,"by":109,"text":110},"18792781","subway","From shifty security practices to binaries in the git repo, nothing about this looks serious.",{"value":112,"source":84,"evidence":113},"Binding \u002Ftmp and \u002Fdev is a container escape risk",[114],{"id":115,"by":92,"text":116},"18794170","> If I get good feedback, I'll rewrite this in proper python code. I don't mind it being a shell script. So is arch-chroot, which is an amazing little tool. > > I have some…",{"value":118,"source":84,"evidence":119},"Relies on bchroot, a beta tool with unaudited security",[120,121],{"id":91,"by":92,"text":93},{"id":122,"by":92,"text":123},"18794176","Most of the common chroot tools? Like arch-chroot? Depending on your own tool is fine, but it does mean you don't have a team of people ensuring that security holes are plugged.…",{"value":125,"source":84,"evidence":126},"Assumes x86_64 and \u002Fbin\u002Fbash, copies resolv.conf blindly",[127],{"id":91,"by":92,"text":93},{"value":129,"source":84,"evidence":130},"Linux-only support seen as not serious",[131],{"id":132,"by":133,"text":134},"18792595","cipherzero","Is this a serious project? > Linux only support > > Tell your employer to stop using Macintosh ... because that doesn’t seem like a sign of a serious project to me...",[136,140,147,151,156],{"value":137,"source":84,"evidence":138},"Use GitHub releases instead of committing binaries",[139],{"id":100,"by":101,"text":102},{"value":141,"source":84,"evidence":142},"Add MD5 or stronger hash verification on install",[143],{"id":144,"by":145,"text":146},"18792593","ironmagma","Seriously. At least add in an MD5 hash, jeez.",{"value":148,"source":84,"evidence":149},"Use tmpfs or ramfs instead of binding host \u002Ftmp",[150],{"id":115,"by":92,"text":116},{"value":152,"source":84,"evidence":153},"Symlink resolv.conf instead of copying it",[154,155],{"id":91,"by":92,"text":93},{"id":115,"by":92,"text":116},{"value":157,"source":84,"evidence":158},"Use PATH rather than fixed binary locations",[159],{"id":91,"by":92,"text":93},[161,165,171],{"value":162,"source":84,"evidence":163},"How is this better than virtualenv?",[164],{"id":52,"by":53,"text":54},{"value":166,"source":58,"evidence":167},"Can you elaborate on the \u002Ftmp and \u002Fdev binding issues?",[168],{"id":169,"by":11,"text":170},"18794116","The whole shell script is really just because it's a protoype (=Initial commit). If I get good feedback, I'll rewrite this in proper python code. At least for myself it's already…",{"value":172,"source":84,"evidence":173},"Does it work with package managers other than xbps?",[174],{"id":71,"by":72,"text":73},[176,179],{"value":24,"source":84,"evidence":177},[178],{"id":52,"by":53,"text":54},{"value":180,"source":84,"evidence":181},"arch-chroot",[182,183],{"id":122,"by":92,"text":123},{"id":115,"by":92,"text":116},{"comments":185,"answered":37,"key":186},5,[187,188,189],{"id":61,"text":62},{"id":169,"text":170},{"id":190,"text":191},"18794431","> > > I have some concerns about binding \u002Ftmp and \u002Fdev the way you do... > > Can you elaborate what exactly the issues is? I use this quite often. > It's a container escape. The…",{"commenters":34,"max_depth":37,"maker_replies":185,"first_comment_mins":193,"lifespan_hours":194},105,13,[196,198,201,202,204,206,208,209,210,213,215,216,217,219,222,225,228,229],[91,31,32,197,92,31],"project\u002Fcritical\u002Fexecution",[199,31,31,200,53,31],"18794114","commenter\u002Fneutral\u002Fnone",[122,31,31,200,92,31],[61,31,31,203,11,32],"project\u002Fneutral\u002Fprivacy",[169,31,31,205,11,32],"project\u002Fneutral\u002Fexecution",[115,31,32,207,92,31],"project\u002Fcritical\u002Fprivacy",[190,31,31,203,11,32],[100,32,32,197,101,31],[71,211,39,212,72,31],2,"project\u002Fneutral\u002Fidea",[75,211,31,214,11,32],"maker\u002Fneutral\u002Fexecution",[104,39,32,207,105,31],[144,39,32,207,145,31],[52,37,39,218,53,31],"project\u002Fmixed\u002Fdocs",[220,185,31,221,11,32],"18794100","maker\u002Fneutral\u002Fidea",[132,223,32,224,133,31],6,"project\u002Fcritical\u002Fnone",[226,223,31,200,227,31],"18792729","dang",[108,223,32,197,109,31],[230,223,32,197,53,31],"18794108",[],[233,237,241,246,250,255],{"id":234,"name":235,"points":236,"category":20},"18776496","rrweb",353,{"id":238,"name":239,"points":240,"category":20},"18789268","Vector Logo Zone",275,{"id":242,"name":243,"points":244,"category":245},"18776589","Pg-extend-rs",244,"infrastructure",{"id":247,"name":248,"points":249,"category":20},"18787777","Bake",132,{"id":251,"name":252,"points":253,"category":254},"18798209","Snigl",87,"languages",{"id":256,"name":257,"points":258,"category":254},"18790255","LJS",77,false,"v2",{"id":262,"name":5,"line":6,"ai":259,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":263,"top":18,"kw":264,"maker":11,"domain":10,"tier":19,"attempts":31,"strip":265,"url":9,"mix":266,"praise":83,"objection":96,"sub":21},18792164,-0.53,[24,25,26,27],"100001013011301011",[31,32,32,33],1794036573154]