4 ms·
security should be enforced in one place in a way that's applicable to all programs, no matter their packaging. How do you do that without placing contraints o
by tremon 6y ago
security should be enforced in one place in a way that's applicable to all programs, no matter their packaging.
How do you do that without placing contraints on said packaging, though? Will you just blanket-restrict all packages to the strictest security measures? i.e. no network, no access to persistent storage, w^x on all pages? Or will you only provide token security because all features are useful to some apps, and you can't know beforehand what features the app actually needs?
- yellowapple 6y ago> Will you just blanket-restrict all packages to the strictest security measures? Seems like a reasonable default to me. And indeed, that seems to be more or less exactly what Firejail does if it doesn't have a profile already for an application: https://firejail.wordpress.com/documentation-2/ https://firejail.wordpress.com/documentation-2/