I'm not a fan of Deno's security model (2024)

I actually have a terminal program that needs to ask for sensitive inputs from the user sometimes, potentially after attacker data has been printed. I've been trying to figure out how I should handle that!

My plan was to encode to Unicode (lossily), strip out control characters, and add some visual framing. Anything else I should be considering? Is there a standard approach? Haven't actually done the research on this yet, but since it came up here, I figure someone might know.

(This is https://codeberg.org/timmc/breakmancer if anyone is interested.)

Deno has 1 year of official support left...

I liked the security model because at least they had something, unlike node.

Lucky for them. Deno is dead.

> the permission prompt is “partially visible” (you can see an emoji)

Terminals can be configured to render emoji in text presentation form where they become monochrome glyphs that can be colored like ordinary text with escape sequences. Not something to hinge your security model on.

Very well written, and excellent points! Thank you.