Running a Twitch channel that he mentions in this video. www.twitch.tv/goldenvcr

Yeah, security is a top concern in how I've designed this system. When your script code is executed, it's run in an isolated V8 context - i.e. just a plain JavaScript interpreter, not something like Node where it might be able to make HTTP requests, access the filesystem, etc. - and the process that runs user code in V8 is completely isolated from the rest of the backend. It can't access the database, and it's never given access to any privileged information. Like, let's say we want a script to update your Twitch stream title. You can probably imagine a naive approach where we just give the JavaScript runtime your Twitch API token, so when it runs the setStreamTitle function, it can just make a call to the Twitch API. That's not what we do. (Because, among other reasons, we don't want privileged information that could be used to control your Twitch account just floating around in memory on the same system where we run arbitrary user-supplied code.) Instead, there's a backend service (the same one that handles connecting your Twitch account) that keeps your Twitch API token securely stored in a database. That service is the only thing that can make Twitch API requests on your behalf. When you call setStreamTitle in a script, what *actually* happens is that the script runtime makes a gRPC request to that service (properly authorized to prove that it's being called from a script in *your* organization), asking it to set the stream title. That way, your Twitch API token never has to leave its cozy home within the service that owns it. So, practically speaking, the only way for a viewer to hijack your scripts with a chat command would be if you were passing their message directly to the eval() function: like, if you made a command that let them write "!eval 5 + 5" and get back "10", then they could also do "!eval o.twitchAccounts.myAccount.setStreamTitle('foo')" and set your stream title... which is why it's never a good idea to pass user-controlled input to the eval() function. Either way, the system is designed so that your scripts can only access resources in *your* organization, with only the information that's *meant* to be accessible to scripts. You can't even access *your* confidential data (access tokens etc.), let alone anyone else's, so a malicious user still wouldn't be able to wreak total havoc. These sorts of fun design questions are a big part of what motivated me to keep scaling up this little personal project - and at some point, I'd love to make another video or two explaining the architecture of the project in more detail.

@@AlexForsythe Thank you so much for the detailed answer, it's a fascinating topic =) I wouldn't mind more videos about this project.

Or better yet, the psychopaths who use them to commit these atrocious acts.

@Foxtrot_III yep, treat the symptoms not the cause 🙄