3 ms·
You can do strict sandboxing on Linux, too (e. g. with Flatpak).
by notpushkin 4y ago
You can do strict sandboxing on Linux, too (e. g. with Flatpak).
- michaelt 4y agoYeah, but that only sandboxes the applications that opt in. If you want to stop malicious applications from doing malicious things, even when the system owner unwisely grants them permission, you need mandatory sandboxing that the system owner can't bypass. And that isn't compatible with the free software ethos.
- roblabla 4y agoI don't think that's necessarily true. All you need is default-on sandboxing that is "painfully obviously wrong" for the system owner to bypass. As a case in point, look at macOS. You can bypass almost every security feature in macOS by rebooting to recovery and disabling CSR, AMFI and whatnot. And even after disabling all this, touchID will still work, and I believe it will still be accepted as a platform authenticator. I think something similar could be compatible with free software ethos.
- notpushkin 4y agoThis exactly. Bypassing sandbox should be like installing software from tarball as opposed to package managers: possible but pretty much discouraged, an “escape hatch” of sorts.