I'm vaguely concerned about installing dot (and cowsay) because it's possible that they include features which can execute arbitrary commands and compromise the security of a host. Mercurial had such a vulnerability recently, see D12112 for some discussion. It is is unlikely that dot or cowsay have such issues, but I suspect neither program (particularly cowsay) was developed with malicious input at the forefront of design considerations, and the more binaries we execute directly, the greater our exposure.

I'd like to sandbox these commands by exposing them as a service which runs on a tier without any access to the VPC or instance data. This is straightforward technically (both commands accept well-defined inputs and emit a single well-defined output), which is part of why I want to sandbox them (we reasonably can, and doing so strictly improves security). However, a lot of pieces are missing: we don't currently run other services outside of the VPC, the authentication and API primitives Phabricator exposes aren't perfect fits, and we don't have much of the glue we'd need written yet.

These challenges are surmountable and we can cheat pretty aggressively on some of them (worst case is that dot doesn't work until I can go kick the service, which isn't a big deal), but definitely more work than apt-get install dot.

I appreciate your concern for safety!

I don't think the need for dot is strong enough to risk opening a hole. But cowsay... ;)

Yeah, this is definitely motivated mostly by cowsay, we'd just get dot for free.