3 ms·

What you describe as broken by design in terms of security is in fact its primary advantage from my perspective: With the security nightmare that is modern web

What you describe as broken by design in terms of security is in fact its primary advantage from my perspective: With the security nightmare that is modern web browsers I do not want any of them which runs on my machine to be able to access a single bit of more data than which is necessary. Firejail helps a lot for this purpose, but fixing the browser to not be able to spy on other X applications requires sticking them into a Xpra sandbox, which greatly intereferes with performance and is a hell of an ugly hack (it's like running a local VNC server and connecting locally to it). Putting software into different user accounts isn't a solution either because the usability of that is well, unusable.

nsajko 7y ago
Use different users and/or virtual machines if you want security. BTW, Firejail is also shit, it had some stupid design decisions and security bugs. And it basically relies on Userspace namespaces which are or were an experimental/unsecure feature in Linux. Wayland's security model is bonkers because the attack surface it implies is just too great. BTW, Is useradd not usable for you?
- qcowhwcugwcgoiu 7y ago
  > Use different users and/or virtual machines if you want security. The Internet is so important that for daily computer usage I, and probably everyone else, have a browser open at basically any point in time. So do you want me to switch users between the $browser_user and $main_user every 5 minutes I need to do something outside of the browser?
  - nsajko 7y ago
    I just run chromium as my main user (but usually with a temporary scripted --user-data-dir and HOME environment variable), because it is relatively secure. And switching Linux consoles/X servers is just two key presses anyway.
    - nsajko 7y ago
      Correction: usually it is three key presses: Control, Alt, F3; for example.
  - ohithereyou 7y ago
    >Do you want me to switch users between the $browser_user and $main_user every 5 minutes I need to do something outside of the browser? xnest[1], ftfy [1] https://www.x.org/archive/X11R7.5/doc/man/man1/Xnest.1.html https://www.x.org/archive/X11R7.5/doc/man/man1/Xnest.1.html
- qcowhwcugwcgoiu 7y ago
  > and/or virtual machines if you want security. ... and w.r.t. that: The modern JavaScript jungle that is the Internet is slow enough already. And we're not even getting started with watching videos here...

nsajko 7y ago

Use different users and/or virtual machines if you want security. BTW, Firejail is also shit, it had some stupid design decisions and security bugs. And it basically relies on Userspace namespaces which are or were an experimental/unsecure feature in Linux. Wayland's security model is bonkers because the attack surface it implies is just too great. BTW, Is useradd not usable for you?

qcowhwcugwcgoiu 7y ago
> Use different users and/or virtual machines if you want security. The Internet is so important that for daily computer usage I, and probably everyone else, have a browser open at basically any point in time. So do you want me to switch users between the $browser_user and $main_user every 5 minutes I need to do something outside of the browser?
- nsajko 7y ago
  I just run chromium as my main user (but usually with a temporary scripted --user-data-dir and HOME environment variable), because it is relatively secure. And switching Linux consoles/X servers is just two key presses anyway.
  - nsajko 7y ago
    Correction: usually it is three key presses: Control, Alt, F3; for example.
- ohithereyou 7y ago
  >Do you want me to switch users between the $browser_user and $main_user every 5 minutes I need to do something outside of the browser? xnest[1], ftfy [1] https://www.x.org/archive/X11R7.5/doc/man/man1/Xnest.1.html https://www.x.org/archive/X11R7.5/doc/man/man1/Xnest.1.html
qcowhwcugwcgoiu 7y ago
> and/or virtual machines if you want security. ... and w.r.t. that: The modern JavaScript jungle that is the Internet is slow enough already. And we're not even getting started with watching videos here...