There is absolutely no protection in the beam against untrusted code. Any process can just Process.list and then call VM functions to look at them. Now, that doesn’t mean that any process can just “write to the state” of some other process. A process is still the only thing that can write to its own heap. Other processes can send send some pid P messages but it’s entirely up to P what it does with those messages and whether it updates its internal state.
If you’re teaching a class or something it’d probably be fine to just tell people “you’ll be penalized if you intentionally mess with other people’s pids in a nefarious way”. If you’re accepting code from people on the internet I’d uh, not accept code from people on the internet. The beam just simply wasn’t built for running untrusted code.
P.S. However, all of those dire warnings were based on the idea that the code you’d be running was elixir / erlang code. If you let folks write their logic in Lua then you could use GitHub - rvirding/luerl: Lua in Erlang · GitHub inside processes to execute that lua, and that should be perfectly safe as long as you don’t intentionally expose dangerous functions to the lua / erlang bindings.
