Hacker News new | ask | show | jobs
by snotrockets 1257 days ago
I'm surprised that AfterEffects plugins are allowed full shell access, and aren't sandboxed in any way.
3 comments

I think you're vastly overestimating the sophistication of the average (and even above-average) plugin (eco)system. Most are just DLL's that call some predefined functions.

Besides - network access is one of the most basic functionalities of any scripting in 2023 (it was in 2013, too). How would one disallow a simple call like in the OP? I mean, they use curl to make it (even) easier to craft an HTTP call, but doing the same from straight system calls is trivial, too.

The high end VFX industry has some of the most hostile DRM one can think up, to the point that moving on from x86 macOS is going to be a major pain because half of the DRM rootkits will stop working.
Apple silicon doesn't seem to have a problem with USB hardware dongles, which arguably is the meat of their DRM
And that this license check puts seemingly unescaped strings in a shell command.