2 ms·
> They don't advertise, but they have the same issues, which should be dealt with. Which is possible, specifically by deferring to something like Firejail that
by yellowapple 6y ago
> They don't advertise, but they have the same issues, which should be dealt with.
Which is possible, specifically by deferring to something like Firejail that can handle any application rather than expecting every application format to bake in its own subtly-different mechanism. That is:
> I don't think it's fine to just say "security doesn't concern us" in the year 2021.
That ain't what's being said. What these folks are actually saying is that security and packaging are separate concerns, and that said security should be enforced in one place in a way that's applicable to all programs, no matter their packaging.
- tremon 6y agosecurity should be enforced in one place in a way that's applicable to all programs, no matter their packaging. How do you do that without placing contraints on said packaging, though? Will you just blanket-restrict all packages to the strictest security measures? i.e. no network, no access to persistent storage, w^x on all pages? Or will you only provide token security because all features are useful to some apps, and you can't know beforehand what features the app actually needs?
- yellowapple 6y ago> Will you just blanket-restrict all packages to the strictest security measures? Seems like a reasonable default to me. And indeed, that seems to be more or less exactly what Firejail does if it doesn't have a profile already for an application: https://firejail.wordpress.com/documentation-2/ https://firejail.wordpress.com/documentation-2/