3 ms·

I don’t think the goal of the software is to be hardened from all attacks from every angle. I think they are trying to prevent human error by compartmentalizin

• dpwm 8y ago
  Also, the vast majority of breaches are due to this human error. Anything that attempts to mitigate that in one way or another is to be welcomed. From browsing the docs[0], CLIP OS looks like an interesting project. However, I do question how much of it is. One of the more interesting approaches using containerization in recent years is sandstorm.[0] It's unfortunate it wasn't a commercial success, because a lot of the ideas in there would go a long way to mitigating the majority of breaches that can occur at the userspace level. In sandstorm, web apps are containerised in a really minimal environment. Each app only has access to files it operates on. There is no procfs or sysfs. All communication with the outside world takes place through a unix socket that is opened by the supervisor.[2] [0] https://docs.clip-os.org/clipos/architecture.html https://docs.clip-os.org/clipos/architecture.html [1] https://sandstorm.io/ https://sandstorm.io/ [2] https://docs.sandstorm.io/en/latest/using/how-it-works/ https://docs.sandstorm.io/en/latest/using/how-it-works/