TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A post published on August 31, 2024, criticized Deno’s security model, focusing on terminal-based permission prompts and the way `–allow-run` identifies commands. The author argued that these features can give users a misleading sense of control; the post is an argument, not evidence that every Deno program or permission prompt is unsafe.
A developer criticized Deno’s permission system in a post published August 31, 2024, arguing that terminal-based approval prompts and command-name permissions can undermine the security users expect from the runtime. The claims concern the design and use of specific controls; they do not establish that Deno’s entire security model has been defeated.
The post, published on goldstein.lol under the title “I’m not a fan of Deno’s security model,” examines Deno’s permissions for access to resources such as files and subprocesses. Deno’s approach lets users grant access through command-line flags, and programs can also request permissions while running. The author described the model as “fundamentally insecure and misleading,” a characterization that reflects the author’s argument rather than an independently established finding.
The first concern is that permission requests appear as text in the terminal, while a program can also write to standard output and read standard input. The author argues that untrusted code could manipulate the terminal display or affect input so that a user does not see, or does not properly evaluate, an approval request. The post says a particular problem shown in a screencast was later patched, while a concern involving terminal colors remained. It also says a related issue was closed in 2026 because the prompt was considered partially visible and terminal-color changes could be a valid use case for AI agents.
The second concern involves `–allow-run`. The post argues that permitting a command by a short name, such as `uname`, does not necessarily identify one fixed executable. Deno searches directories in the process’s `PATH`; the author says a script can set a different `PATH` for a child process without a separate permission, potentially causing a different executable with that name to run. The post illustrates this with a shell script that prints “lol” in place of the expected command.
What Terminal Prompts Can Protect
The critique matters to developers because a permission system is useful only if its controls mean what users believe they mean. A prompt can ask a user before granting access, but the author’s concern is that a prompt rendered in a terminal already controlled by the running program may not provide a dependable way to distinguish a trustworthy request from a manipulated one. That is a design-risk argument, not proof that every prompt can be bypassed.
The `–allow-run` example raises a separate issue: permissions based on a command name can be ambiguous if the executable selected depends on a mutable environment such as `PATH`. Developers using Deno to run code they do not fully trust may want to understand precisely how command resolution and permission scope work. The source does not quantify how often either scenario occurs or establish the likelihood of exploitation in real deployments.
Popular right now
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
Dyson 360 Vis Nav Robot Vacuum
As an affiliate, we earn on qualifying purchases.
How Deno Grants Permissions
Deno is a JavaScript runtime built on V8, with its own standard library and tooling. Its security design includes permissions that can restrict operations such as reading files or running subprocesses. Users can supply permissions at launch, while code can request some permissions during execution. The post’s example grants read access to a specified directory and permission to run `uname`.
The author’s focus is not a newly reported breach, but whether these mechanisms communicate and enforce boundaries as intended. The post distinguishes between a specific terminal-prompt behavior that it says was patched and broader concerns about trusting terminal input and output. It also uses a changed `PATH` example to question whether an allowed command name reliably corresponds to the executable a user had in mind.
““fundamentally insecure and misleading””
— The author of the August 31, 2024, post
Limits of the Reported Evidence
The source is a single author’s critique, not a formal security audit or a report of a confirmed attack against users. It does not provide independent testing, affected-version details, or evidence about how commonly the described conditions occur. The source says one specific prompt issue was patched, but the supplied material does not identify the patch version or explain its scope.
The post’s account of a 2026 issue closure is also brief. It does not include a response from Deno maintainers, a full issue discussion, or enough detail to determine whether the unresolved terminal-color concern was accepted, disputed, or addressed elsewhere. The material ends while discussing command permissions, so it does not lay out the author’s complete proposed remedy.
Questions for Deno Users
Readers evaluating the critique would need to check Deno’s current documentation and issue tracker for the exact behavior of permission prompts, command resolution, and any changes since the post. The supplied source does not announce a planned fix or a forthcoming response from the project, so no next release or remediation timeline can be confirmed.
For developers, the immediate practical question is whether a project’s threat model treats the code being run as untrusted and whether its permissions identify the resources and executables intended. The post makes a case for scrutiny of those details; further conclusions depend on version-specific behavior and independent testing.
Key Questions
What did the 2024 post criticize?
It argued that terminal-based permission prompts could be manipulated and that `–allow-run` permissions based on command names could resolve to an unintended executable through `PATH`.
Does the post prove Deno is insecure?
No. It presents an author’s analysis of particular design risks. The supplied material does not include an independent audit or establish that all Deno permission controls are ineffective.
What happened to the prompt issue?
The post says a specific issue demonstrated in a screencast was patched. It also says a prompt-related issue was closed in 2026 on the grounds that the prompt remained partly visible and terminal-color changes could serve legitimate uses. The source does not give the patch version or the full issue discussion.
Why does `PATH` matter to `–allow-run`?
The author argues that allowing a short command name may not identify one fixed executable because command lookup uses directories in `PATH`. In the example, code changes the child process’s `PATH` so a different script with the same name runs.
Source: goldstein.lol
![The GNU Emacs Architecture: Unlocking The Core [Pdf]](https://designthinkingblog.com/wp-content/uploads/2026/07/the-gnu-emacs-architecture-unlocking-the-core-pdf-featured-560x300.jpg)
