5 ms·
> The difference is that while Capsicum provides you with very solid, ... ... That nothing uses. And even their flagship research example, Chrome, has never ma
by notaplumber 8y ago
> The difference is that while Capsicum provides you with very solid, ...
... That nothing uses. And even their flagship research example, Chrome, has never made it into the FreeBSD ports tree.
OpenBSD has pledge(2)/unveil(2) for Chrome.
- trasz 8y agoNot true - Capsicum is used by a growing amount of software, from base system utilities (like uefisign(8)) or servers (like ctld(8)) to third party stuff, like Irssi. And yes, there are language bindings as well. The problem with Chrome is not that it’s hard to capsicumize - it’s not, it has been done and documented - but rather that the upstream developers are extremely uncooperative wrt accepting patches.
- notaplumber 8y agoHuh? FreeBSD has never included the Capsicum patches for chromium in ports. Google not accepting this upstream is a separate issue, albeit regretful, OpenBSD maintains the pledge/unveil patches and users benefit from this work today, whereas FreeBSD users cannot run Capsicum-ised Chrome. Capsicum patches are also considerably more intrusive, and their intention and protection is less clear.
- OpenBSD-reich 8y agoYou're getting heavily downvoted. Obvious FreeBSD shill army is obvious! I really appreciate Theo's approach to operating system security, and the ecosystem as a whole is very much indebted to the OpenBSD project for its advancements.