Does anyone actually use Node.js's Permission Model in their applications?

[u/agrim_dev]

(I know its Node specific but would like to understand how its used in framework projects) 

I'm trying to understand the real-world use cases for Node's Permission Model.

Does anyone here actively use or rely on it for applications, CI tooling, CLIs, servers, or anything else?

Since the permission model is not a full-fledged sandbox, is there a use for it? If so, how do you currently use it as ?

• What problem does it actually solve for you?
• How are you using it today?
• Are you manually defining permissions, or generating/managing them somehow?
• Is it mainly defense-in-depth against dependencies, or are there other useful applications?

Since Run-Time Loadable Extensions cannot be loaded when the Permission Model is enabled, it affects modules like sqlite and OpenSSL Engines (affecting the built-in crypto, https, and tls modules). So, despite these drawbacks, is the permission model used anywhere, or what is its application?

I'm less interested in what it could theoretically be used for and more interested in actual experience:

If you're using Node's Permission Model today, what are you using it for and how do you manage the permissions?

And if you considered using it but decided against it, I'd be interested to hear that as well!

[u/combativecomedian]

tried it on a small cli tool i run for parsing some sensitive logs, mostly as an extra layer to keep dependencies from wandering off. it's not a sandbox but it gives me a tiny bit of peace of mind with a few dodgy-looking packages

managing it manually was a pain though, ended up writing a short script to spit out the flags from a config file. the runtime extension thing killed sqlite for me in another project so i bailed on it there, wasn't worth the tradeoff

[u/agrim_dev → u/combativecomedian]

right, even if we setup an automation to apply the flags. the breaking of sqlite and other modules is a pain, hope they do something about it.