3 ms·
Since I run all reasonably trusted open source software on my computer the sandboxing aspect of Wayland doesn't really help me. The one exception to this is the
by upofadown 9y ago
Since I run all reasonably trusted open source software on my computer the sandboxing aspect of Wayland doesn't really help me. The one exception to this is the browser as those things now expose a vast attack surface. Unfortunately browsers are not sandboxed and they become significantly less functional if you somehow manage it. I don't care if my browser can't see the rest of the screen if it can see all my files and everything I do in other tabs on that browser.
So the benefits of the easier sandboxing provided by Wayland are somewhat overstated, at least for typical Linux users.
- cesnja 9y agoYou can run the browser process in a separate mount namespace, only allowing it to access, for example, downloads folder, while everything else is off limits. I recommend Firejail.