3 ms·
Furthermore I kind of wonder if anybody bringing up this point has ever in their life seen or heard of a malicious X11 client ... I know this is not how securi
by asveikau 7y ago
Furthermore I kind of wonder if anybody bringing up this point has ever in their life seen or heard of a malicious X11 client ...
I know this is not how security works (a theoretical hole is often as bad as a practical one) but it's a bit like saying you should have antivirus software, to which I might say: where are the viruses?
- Bnshsysjab 7y agoIf containerisation takes off and ends up being perfect security it’ll make sense. An example would be running Android on X, apps would be able to read / modify windows of other apps via The X socket.
- michaelmrose 7y agoWhy would anyone suppose that containers on Linux which are designed to keep applications isolated enough not to interfere with each other ends up being perfectly secure when it's not really designed to be secure at all?
- Bnshsysjab 7y agoI’m not suggesting it’s sane particularly if your threat model is nation state level actors, but people use containers (chroot, docker, vms) as a security boundary all the time.
- michaelmrose 7y agoNeither chroot or docker is a worthwhile security boundary. People that act as if it is risk appearing incompetent when they get compromised.
- Bnshsysjab 7y agoI’d argue that anything but bare metal is not a good compromise, but I’m not balancing the books of a large company. People care about docker escapes so they’re getting more difficult, at least. Edit: Plus, I’d rather $app_i_dont_fully_trust be sitting in a container rather than on my host. And no, not running apps i don’t fully trust is not something which is at all viable for me.