4 ms·
Sandstorm's updates are closer to Chrome's than regular open source software. Stick to the 'release' channel can you can be sure that you're always up to date.
by mnutt 11y ago
Sandstorm's updates are closer to Chrome's than regular open source software. Stick to the 'release' channel can you can be sure that you're always up to date. And Sandstorm locks its apps down so tightly that they often don't suffer from the same security vulnerabilities the same apps do outside Sandstorm.
That being said, to roll your own you'll need to run a box somewhere, select secure defaults, and keep on top of patching the box itself. It's not worth it unless you're really willing to spend the time to do it correctly.
- kentonv 11y agoEh, honestly, if you're not running anything else on the box, you probably don't have to be overly proactive about maintaining it. Sandstorm handles updating its own dependencies and mitigating most kernel bugs. Maybe if you're leaving sshd open to the internet that's something to worry about, although if you read HN you'll surely know when that needs patching. :) That said, we plan to build a "Sandstorm OS" that auto-updates everything including the kernel, and doesn't even have an SSH interface (wouldn't be useful anyway).