4 ms·

Probably a very stupid question, but I'm wondering if containers (which are extremely popular nowadays) can help us to improve web security? What I mean is, th

by kovrik 10y ago

Probably a very stupid question, but I'm wondering if containers (which are extremely popular nowadays) can help us to improve web security? What I mean is, that all major browsers are trying to create their own sandbox environment to be more secure, right? But maybe it is better to do the other way round: give them all permissions, but put them in a controlled and restricted sandbox environment (container). And browser window will be just a small app that talks to that container, sends requests and gets resulting page (rendered) and just shows it? So, it will literally have no access to outside of the container. As a bonus, it decouples UI from backend. Asking, because the purpose of containers is to isolate and create sandbox environments, and the purpose of browser is to render and show web pages. So why do browsers care about security, if we already have containers? Or that makes no sense and gives no advantage/security?

tedunangst 10y ago
?? This is a sandbox escape exploit. Calling a sandbox a container isn't going to stop the exploit.
viraptor 10y ago
> major browsers are trying to create their own sandbox environment This is partially true: for example there are sandboxes considering the website origin and related restrictions, but on the process level browsers reuse the system mechanism instead of implementing their own. For example on linux, chrome uses seccomp and a number of other ways to separate the ui from the backend. Windows has its own solutions for this. So I don't think it's right to say they create their own sandboxes. At least not in a NIH meaning. Containers are just a fancy package for the protections offered directly by namespaces and other existing restrictions. User namespaces are already used in chrome sandboxes for example (https://chromium.googlesource.com/chromium/src/+/master/docs/linux_sandboxing.md#User_namespaces_sandbox.md https://chromium.googlesource.com/chromium/src/+/master/docs...)
technion 10y ago
Have a look at what Microsoft is doing with Edge and Application Guard: https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge https://blogs.windows.com/msedgedev/2016/09/27/application-g...

by kovrik 10y ago

tedunangst 10y ago

?? This is a sandbox escape exploit. Calling a sandbox a container isn't going to stop the exploit.

viraptor 10y ago

> major browsers are trying to create their own sandbox environment This is partially true: for example there are sandboxes considering the website origin and related restrictions, but on the process level browsers reuse the system mechanism instead of implementing their own. For example on linux, chrome uses seccomp and a number of other ways to separate the ui from the backend. Windows has its own solutions for this. So I don't think it's right to say they create their own sandboxes. At least not in a NIH meaning. Containers are just a fancy package for the protections offered directly by namespaces and other existing restrictions. User namespaces are already used in chrome sandboxes for example (https://chromium.googlesource.com/chromium/src/+/master/docs/linux_sandboxing.md#User_namespaces_sandbox.md https://chromium.googlesource.com/chromium/src/+/master/docs...)

technion 10y ago

Have a look at what Microsoft is doing with Edge and Application Guard: https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge https://blogs.windows.com/msedgedev/2016/09/27/application-g...