logoalt Hacker News

jbverschoor • today at 5:58 PM • 2 replies • view on HN

Again, it’s blacklisting so kind of impossible to get right. I’ve looked at this many times, but in order for things to properly work, you have to create a huge, huge, huge, huge sandbox file.

Especially for your application that you any kind of Apple framework.

Replies

simonw • today at 6:18 PM

This doesn't look like it's blacklisting to me. It's an allowlist system:

  --allow-net=api.openai.com # Explicitly allow access to that host

  --allow-write=config.txt # Explicitly allow write to that file
➕ show 1 reply
afshinmeh • today at 6:18 PM

That's interesting, thanks for sharing that. Could you elaborate a bit more? I'd like to understand the use case is a bit better.