Hacker Read

ampdepolymerase | karma 1529 | avg karma 2.07 · 2021-02-21 15:06:38

The way iOS and Fuchsia are dealing with the problem is to completely lockdown the operating system with a tight permissions system. An app can be compromised but the damage is limited. Perhaps it is time for servers to move to a similar model.

giantrobot | karma 5286 | avg karma 2.0 · 2021-02-21 15:13:17

We should call this newly invented and wholly original concept a "container". The software gets "contained". It just might work. /s

eecc | karma 4200 | avg karma 2.48 · 2021-02-21 21:38:51+00:00

You mean cgroups, or zones don’t you? Docker (was, last time I heard) a security disaster, not generating robust layer hashes, lacking user isolation, and plenty just running as root...

giantrobot | karma 5286 | avg karma 2.0 · 2021-02-21 16:30:05

There's more to containers on Linux than just Docker.

ampdepolymerase | karma 1529 | avg karma 2.07 · 2021-02-22 00:37:21+00:00

To be fair you need to go to the hypervisor level (like Firecracker) to get any decent level of sandboxing.

progval | karma 4683 | avg karma 3.58 · 2021-02-22 03:03:22

For security by isolation, you don't even need containers. Just run each application as its own user.

This is already done by most (all?) daemons packaged in Debian that don't need to be root.

reply

loloquwowndueo | karma 3657 | avg karma 3.17 · 2021-02-21 22:02:22+00:00

Just install all your software from snaps on an Ubuntu system ;) (just kidding, snaps have a whole bunch of issues for server software )

AshamedCaptain | karma 6226 | avg karma 3.11 · 2021-02-21 16:33:44

> An app can be compromised but the damage is limited

AKA the "we don't care" security model. What exact use is the fact that the web browser is "contained" if it is compromised? The mail client? Your PIM program? On a server, what use is that the database engine is contained if it is compromised?

I am the first to accept the security benefits of sandboxing, but it is just _one_ thing. It doesn't even help against the majority of issues. Not even on Android/iOS.

reply