A Hacker News post from August 31, 2024 argues that Deno's flagship Secure by default permission system is fundamentally flawed. Deno, a JavaScript/TypeScript runtime built on V8, mediates filesystem and process access via flags like `--allow-read` or runtime prompts displayed in the terminal.
The author demonstrates that because prompts render on stdout and read from stdin without isolation, malicious code can manipulate terminal colors to hide prompts, pre-feed keystrokes, or trick the terminal into sending approval characters. One example shows an attacker hiding the prompt entirely via escape sequences.
The core issue: security-sensitive decisions travel over an attacker-controlled channel. Unlike PolKit GUI dialogs, the terminal offers no trusted path. The author compares it to executing attacker-controlled JavaScript on a webpage then asking for confirmation on the same page.
While a specific screencast vulnerability was patched, the underlying architecture — using in-band terminal signaling for permission grants — remains unchanged.
Source: Hacker News · Summarized by HeadlinesBriefing