Deno has 1 year of official support left...

I liked the security model because at least they had something, unlike node.

Something can be worse than nothing when it tricks users into thinking it provides meanigful security guarentees.

Node actually took that from Deno, they do have a permission model now: https://nodejs.org/api/permissions.html

You're better off relying on OS-level security mechanisms. Not only is it more likely to be much safer/secure, but it also means you don't have to worry about compatibility, missing features, etc. when you switch runtimes/software stacks.

If you like having something for security — even in Node — check out something I invented, called SafeScript.

It’s for executing untrusted code written by others… a large subset of Javascript which guarantees the code can only call the Facades you inject, and you can hook and intercept anything. It works with callbacks and promises.

What’s more is that it runs in WebWorker sandboxes on the web, and uses a proxy to transparently make existing code make same method calls, or use existing objects, like window.document, but to safer versions, which only allow eg createElement.

And because SafeScript automatically awaits every async function, your synchronous calls to HTMLElement methods etc. will be proxied asynchronously and “just work” without changing the original JS code. SafeScript is robust enough that most existing JS components will simply work without changes when ported to SafeScript.

PS: It can also be embedded in PHP, so you can run untrusted handlers there, too, without worrying about PHP’s large security surface.

PPS: SafeScript is deterministic by default, so you can also get the same results across all environments or runs. You can set the random number generator seed yourself, or inject Date.now() as one of your APIs if you want.

Here it is. Should I do a Show HN?

https://github.com/SafeScript/Safescript