I'm not a fan of Deno's security model (2024)

Deno, a JavaScript runtime, markets itself as "secure by default" through a permission system that controls file and system access, but the author argues this approach is fundamentally insecure and misleading. The main vulnerabilities include malicious code exploiting terminal APIs to interfere with permission prompts through stdout/stdin, and the ability for code to bypass permission restrictions through direct library access without proper filtering. The author contends that while Deno's permission concept is sound, the implementation fails to adequately prevent sophisticated attacks that compromise the claimed security benefits.