diff --git a/packages/lockdown/NEWS.md b/packages/lockdown/NEWS.md new file mode 100644 index 0000000000..4762acdac5 --- /dev/null +++ b/packages/lockdown/NEWS.md @@ -0,0 +1,19 @@ +User-visible changes to `@endo/lockdown`: + +# Next release + +- Changed `@endo/lockdown/commit-debug.js` so that it now sets + the `lockdown` option `errorTaming: 'unsafe-debug'` instead of + just `errorTaming: 'unsafe'`. This is a further loss of safety in + exchange for a better development experience. For testing and debugging + purposes during development, this is usually the right tradeoff. + + In particular, + `errorTaming: 'unsafe'` endangered only confidentiality, whereas + `errorTaming: 'unsafe-debug'` also endangers integrity, essentially by + directly exposing the (non-standard and dangerous) v8 `Error` + constructor API. + + In exchange, stack traces will more often have accurate line numbers into + the sources of transpiled code, such as TypeScript sources. See + [`errorTaming` Options](https://github.com/endojs/endo/blob/master/packages/ses/docs/lockdown.md#errortaming-options) for more on these tradeoffs. diff --git a/packages/lockdown/commit-debug.js b/packages/lockdown/commit-debug.js index 9595aa0a94..03e02a2197 100644 --- a/packages/lockdown/commit-debug.js +++ b/packages/lockdown/commit-debug.js @@ -21,7 +21,7 @@ lockdown({ // NOTE TO REVIEWERS: If you see the following line commented out, // this may be a development accident that should be fixed before merging. // - errorTaming: 'unsafe', + errorTaming: 'unsafe-debug', // The default `{stackFiltering: 'concise'}` setting usually makes for a // better debugging experience, by severely reducing the noisy distractions