I take your point about php safe mode. Its failings, as I see them, are: 1. It gets in the way of normal functionally, so people turn it off. 2. There are ways around it, so It provides only the illusion of safety.
So far as I can tell, neither of these is true of the node changes. In the this case, which is a multi-tenanted server containing untrusted code, the functionality of the application needs to be restricted. My model was the Java Security Manager, which lets you define specifically the capabilities if the application and the capabilities of untrusted code (e.g. code loaded by specific class-loaders.) In fact, if I develop this further, it will be to make the notion of safety more granular, as Java does. This makes failing (1) less likely. And, given that the only way for node.js to access external resources like the file system and the network are via native-code modules, the combination of - Checking for allowed capabilities inside the core node modules, and - Disallowing the loading of additional native code should address failing (2)
