Re: Fwd: @RISK: Sun Java Floating-Point Value Denial of Service

On Feb 5, 2011, at 7:22, Thomas Leonard wrote:

> Even when it is fixed, there are some other similar DoS problems. For
> example, given a remote object e.g.
>
>  def service {}
>
> a client can DoS it easily with e.g.
>
>  service<-__getAllegedType()<-getFQName()<-size()<-pow(2147483647)
>
> What can I do about this?


DoS is out of scope for E, in general.

The best you can do in theory is arrange so that every client is  
served by a separate vat, and kill hung vats.

In practice, we don't have the ability to kill vats yet. I was at one  
point looking into fixing this for EoJ, by allowing vats to be  
transparently started in new processes; the first step for that was  
making MetaRune.main(["--spawn"]) start a new process as it's supposed  
to. If I remember correctly. The trivial amount of work I did so far  
is available at <git://switchb.org/e-on-java>, branch rune-spawn.

-- 
Kevin Reid                                  <http://switchb.org/kpreid/>