4 ms·
I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running insi
by yzmtf2008 9y ago
I think you have the idea of sandbox (or at least the idea of sandbox in the context of a web browser) backwards: it means an application (webpage) running inside the sandbox cannot access resources not granted. This side channel access does not run inside a sandbox at all.
- abecedarius 9y agoIf you don't consider an OS process a sandbox at all, why are even talking about security here?
- yzmtf2008 9y agoThat’s not the point of GP though? The whole premise of virtualization is that an OS process is not a perfect sandbox. There’s a hierarchy of sandboxes. Protecting other processes from accessing something inside the sandbox is not the job of a browser sandbox. This actually just goes to show the GP’s point: not all sandboxes are created equal.
- abecedarius 9y agoI was not arguing against kibwen, I was sharing some more points. People have implicitly expected OS processes to be better isolated from each other than they are. (I think there's a related problem that people tend not to think about which of the properties of integrity, confidentiality, and availability they rely on.)