Hacker GitHub

← All repos

endojs/endo

View on GitHub ↗ ★ 1,071 JavaScript

Endo is a distributed secure JavaScript sandbox, based on SES

20 mentions on Hacker News by 15 people: 2 stories, 18 comments · first 2021-11-06 · latest 2026-08-20

Mentions per year 20 mentions · busiest year 2022 (10)
20082026
AllStoriesComments NewestTopOldest
  1. …As it says in that readme, "sandboxed using Secure EcmaScript (SES)": https://github.com/endojs/endo/tree/master/packages/ses (which you might be familiar with, as it is a project of Endo, which Mark Miller helps lead)
    comment by danjm1 · 2026-08-20 · in Extensible Software in the age of LLMs
  2. …( https://github.com/changesets/changesets ) is a much better approach. We adopted it in Endo ( https://github.com/endojs/endo/tree/master/.changeset ) and it’s been a clear improvement.
    comment by turadg · 2026-06-05 · in Conventional Commits encourages focus on the wrong things
  3. I don't know if you knew, but endo[1] is already a thing, and a pretty cool thing at that. [1]: https://github.com/endojs/endo/
    comment by pull_my_finger · 2024-07-29 · in Deno: What we got wrong about HTTP imports
  4. I used E in the 90s: http://erights.org/ I haven't kept up with newer systems but I've heard of https://github.com/endojs/endo and just came across http://reports-archive.adm.cs.cmu.edu/anon/home/anon/isr2017... (which says "in the style…
    comment by abecedarius · 2023-07-22 · in Malicious libraries can steal all your application secrets in Elixir
  5. …policies that determine what capabilities will be distributed to third party dependencies." [0] https://github.com/endojs/endo
    comment by dane-pgp · 2023-02-14 · in Harvesting credit card numbers and passwords from your site (2018)
  6. Agoric moved forward and Realms gave way to SES https://github.com/endojs/endo/tree/master/packages/ses And Endo is a set of tools (being) built around it to make it more practical for particular usecases
    comment by naugtur · 2022-11-22 · in Show HN: Run unsafe user generated JavaScript in the browser
  7. …to that. A shim for the entire thing exists, with lockdown and Compartments isolating code: https://github.com/endojs/endo/tree/master/packages/ses https://github.com/tc39/proposal-compartments/ It has usage already, eg. metamask snaps
    comment by naugtur · 2022-11-21 · in Show HN: Run unsafe user generated JavaScript in the browser
  8. SES-shim is the modern successor to that by Doug's old pal Mark and team. https://github.com/endojs/endo/tree/master/packages/ses Also, on its way to being standardized in tc39
    comment by naugtur · 2022-11-21 · in Show HN: Run unsafe user generated JavaScript in the browser
  9. …and policies for SES, which aims to make it into standards. https://github.com/LavaMoat/LavaMoat https://github.com/endojs/endo/tree/master/packages/ses
    comment by Legogris · 2022-11-02 · in Dozens of malicious PyPI packages discovered targeting developers
  10. …an update. Javascript doesn't make that easy though by being so dynamic. SES could maybe help: https://github.com/endojs/endo/blob/master/packages/ses/READ...
    comment by eis · 2022-09-29 · in Deno 1.26 Release Notes
  11. …be performance, which could be addressed by runtime support. https://github.com/tc39/proposal-ses https://github.com/endojs/endo
    comment by 3np · 2022-04-11 · in Node.js packages don't deserve trust
  12. …policies that determine what capabilities will be distributed to third party dependencies. https://github.com/endojs/endo
    comment by dane-pgp · 2022-03-22 · in The De-obfuscated Protestware code from node-ipc that wiped Russian computers
  13. …and it will shortly have its first stable release. [0]: https://github.com/tc39/proposal-ses [1]: https://github.com/endojs/endo/tree/master/packages/ses [2]: https://github.com/LavaMoat/LavaMoat
    comment by Legogris · 2022-03-17 · in NPM package compromised by author: erases files on RU / BY computers on install
  14. …work getting done now! (What made me want to research it was this[1] thread from the other day.) 0: https://github.com/endojs/endo 1: https://news.ycombinator.com/item?id=30215212
    comment by freeqaz · 2022-02-10 · in Node runtime that sandboxes all NPM dependencies by default
  15. …policies that determine what capabilities will be distributed to third party dependencies." https://github.com/endojs/endo
    comment by dane-pgp · 2022-01-09 · in Dev corrupts NPM libs 'colors' and 'faker', breaking thousands of apps
  16. …that it's saner than it really is and even quite experienced people get bitten in the ass by that: https://github.com/endojs/endo/issues/115 That link is not an issue with json, but with javascript (that js treats keys named __prototype__…
    comment by bawolff · 2021-12-27 · in Useful Old Technologies: ASN.1 (2013)
  17. …that it's saner than it really is and even quite experienced people get bitten in the ass by that: https://github.com/endojs/endo/issues/115 Quoting http://seriot.ch/projects/parsing_json.html : In conclusion, JSON is not a data format you…
    comment by patrec · 2021-12-26 · in Useful Old Technologies: ASN.1 (2013)
  18. …Uses the object capability model provided by SES [2]. [1] https://github.com/LavaMoat/LavaMoat [2] https://github.com/endojs/endo
    comment by tmpfs · 2021-11-06 · in Embedded malware in RC (NPM package)