5 ms·

This is sorely needed as part of mainstream desktops due to the extended power of APIs available to web pages like file access for instance.

by cm3 11y ago

MajesticHobo 11y ago
Aren't those already sandboxed browser-local filesystems?
- keeperofdakeys 11y ago
  The browser can still access your disk though, so any vulnerability in your browser means arbitrary access. An example from last year https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ https://blog.mozilla.org/security/2015/08/06/firefox-exploit.... That's the reason that I decided to use firejail myself.
  - MajesticHobo 11y ago
    Okay. So it's a protection against browser exploits, not overreaching web APIs.
    - koolba 11y ago
      Good security has layers. That way if one falls through, hopefully the next layer will catch it.
    - cm3 11y ago
      It's more a boundary for the browser not to pass because it has no business. I've seen an alternative approach which used a separate user account for Firefox and then SSH forwarding of X.
  - cm3 11y ago
    WebTorrent is something I'm afraid to try due to the laws in the place I live and nobody answered me when I asked if WebRTC p2p connections first show a permission popup like Microphone or Speaker access. I don't know how the file access APIs work in JavaScript, but it's scary to think a random website could have a random JS snippet that uploads a file from $HOME.
    - orf 11y ago
      There will of course be a permission pompt.
      - cm3 11y ago
        Good to know, I might try it the next time I'm in another country.
      - cm3 11y ago
        Come to think of it, why doesn't a WebRTC connection on something like appear.in prompt for Network permission?
gcb0 11y ago
don't forget that binary blobs and plug ins are more present than ever. before you only had flash, now there's hangouts, flash, silverligth, etc
- cm3 11y ago
  Hangouts work without plugins and just WebRTC, or at least that's what I thought. Does it not?
  - gcb0 11y ago
    You wish. Just because you sold your info and control to google by using chrome doesn't mean everyone have. :) Chrome have it pre-installed, just like microsoft had flash pre-installed. All perfect and dandy until the 0-days start to show up. this is what i get if i try to start a hangout conference: https://www.google.com/tools/dlpage/hangout?hl=en#hangouthttps://plus.google.com/hangouts/_/?authuser=0&hl=en&ht=0&hcb=0 https://www.google.com/tools/dlpage/hangout?hl=en#hangouthtt...

This is sorely needed as part of mainstream desktops due to the extended power of APIs available to web pages like file access for instance.

by cm3 11y ago

This is sorely needed as part of mainstream desktops due to the extended power of APIs available to web pages like file access for instance.

MajesticHobo 11y ago

Aren't those already sandboxed browser-local filesystems?

keeperofdakeys 11y ago
The browser can still access your disk though, so any vulnerability in your browser means arbitrary access. An example from last year https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ https://blog.mozilla.org/security/2015/08/06/firefox-exploit.... That's the reason that I decided to use firejail myself.
- MajesticHobo 11y ago
  Okay. So it's a protection against browser exploits, not overreaching web APIs.
  - koolba 11y ago
    Good security has layers. That way if one falls through, hopefully the next layer will catch it.
  - cm3 11y ago
    It's more a boundary for the browser not to pass because it has no business. I've seen an alternative approach which used a separate user account for Firefox and then SSH forwarding of X.
- cm3 11y ago
  WebTorrent is something I'm afraid to try due to the laws in the place I live and nobody answered me when I asked if WebRTC p2p connections first show a permission popup like Microphone or Speaker access. I don't know how the file access APIs work in JavaScript, but it's scary to think a random website could have a random JS snippet that uploads a file from $HOME.
  - orf 11y ago
    There will of course be a permission pompt.
    - cm3 11y ago
      Good to know, I might try it the next time I'm in another country.
    - cm3 11y ago
      Come to think of it, why doesn't a WebRTC connection on something like appear.in prompt for Network permission?

gcb0 11y ago

don't forget that binary blobs and plug ins are more present than ever. before you only had flash, now there's hangouts, flash, silverligth, etc

cm3 11y ago
Hangouts work without plugins and just WebRTC, or at least that's what I thought. Does it not?
- gcb0 11y ago
  You wish. Just because you sold your info and control to google by using chrome doesn't mean everyone have. :) Chrome have it pre-installed, just like microsoft had flash pre-installed. All perfect and dandy until the 0-days start to show up. this is what i get if i try to start a hangout conference: https://www.google.com/tools/dlpage/hangout?hl=en#hangouthttps://plus.google.com/hangouts/_/?authuser=0&hl=en&ht=0&hcb=0 https://www.google.com/tools/dlpage/hangout?hl=en#hangouthtt...