Re: Arbitrary Sandbox

[Niklas Holsti <niklas.holsti@tidorum.invalid>]

On 12-02-18 22:06 , tmoran@acm.org wrote:
>> I seem to remember that the Burroughs mainframe computers had rather
>> poor hardware-level protections. A buggy or malicious compiler could
>> generate code that had harmful effects that were not restricted to the
>> user running the code, if I remember correctly. A consequence was that
>> an ordinary user was not allowed to create a compiler; special
>> privileges were required to label a program as a "compiler" and thus let
>> it generate executable code.
>
>    The Burroughs philosophy was to design hardware and software together,
> which included doing different kinds of checks in different, appropriate,
> places.

Right. I did not mean to be critical of Burroughs; it is one example of 
dividing checks between SW and HW. Current systems have a different 
division, which is better in some respects -- illegal code has limited 
effects, so anyone can develop and experiment with compilers -- but 
worse in other respects, such as less checks on pointer arithmetic.

> Bad code could be prevented by a correct compiler, so an
> arbitrary generator of bit streams couldn't call its output "executable
> code".  Indexing out of range couldn't be prevented by a compiler, so it
> was checked at run time by hardware.  And so forth.

Yes. The ideal is that all illegalities are detected at some level. But 
today, in Ada and other languages, we have cases of erroneous execution, 
undefined behaviour, and so on, that are not detected at all, and simply 
lead to wrong results or weird crashes. I wish that hardware could 
detect more of them.

> In five years supporting a B5500 at U of Wisconsin, I never saw a core
> dump caused by a compiler generating bad code.  (Unfortunately, Burroughs
> added to their Algol "stream procedures" which were unchecked string
> operations - those were the source of most problems.)

No disagreement from me. I liked the Burroughs systems at the U of 
Helsinki, and I don't remember hearing of any problems. (I was an 
ordinary and minor user, not a sysadmin.)

But perhaps there would have been more problems if I and other students 
in the compiler-implementation course had been allowed to run our 
experimental compilers as real compilers, not just as MIXAL generators :-)

-- 
Niklas Holsti
Tidorum Ltd
niklas holsti tidorum fi
       .      @       .