[Lerc]

It raises the interesting question of what is the best isolation for a browser side sandbox.

Running a worker.

Running a worker running a js implementation.

Running a worker running a wasm module running a js implementation (quickjs) running some passed code.

Running a worker running what kyu build runs.

And then of course the possibility of a environment where you pass it an integer n and it geneates n levels of. Nested layers with a randomly chosen implementation at each layer.

Security by obfuscurity, is that a thing?

Might be fun to implent the kyu wasm files as an executable format on my dumb cli idea. https://lerc.neocities.org/

(Kyu seems to fight my autocorrect wanting to turn it into you)

[nolist_policy]

The best isolation is inside a Service Worker, where the script is served with Content-Security-Policy: sandbox header.[1]

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

[Lerc]

I'm not sure if service workers are particularly amenable to having Developer A provide an interface for User B to run untrusted code made by Developer C, D and E.

[mcapodici]

Or just an iframe?