4 ms·
Separation of concerns is a good idea. Don't run everything together, e.g. multiple boot Os, or nested OS (windows with several WSL setups for different work, t
by Helmut10001 4y ago
Separation of concerns is a good idea. Don't run everything together, e.g. multiple boot Os, or nested OS (windows with several WSL setups for different work, test untrusted windows apps first in windows development VM etc.). If you have a server, run dedicated VMs and work on those via remote, these days you can even stream your games from your dedicated VM. In case a game is compromised, it will at maximum compromise other games on the VM, but not your important work on another VM.
- amelius 4y agoA workflow that involves multiple VMs is usually very cumbersome. I feel that our OSes should solve this problem. Unix was built with the mindset that other users cannot be trusted, but they forgot that applications can also be malicious. There is a huge opportunity here for better OSes.
- transpute 4y agoUntrusted officeapps/browser has been solved on Windows for ~10 years by Bromium (now HP SureStart) and ~5 years by Microsoft cloning Bromium as Application Guard. For example, every tab of the browser runs in an isolated VM, seamlessly composited into the main desktop, with no special action needed by the user.
- tigrezno 4y agoIsn't that the effort done on jails like snap/flatpak lately??
- amelius 4y agoErgonomics is part of the equation and Snap is definitely not there yet, and in fact its poor quality may be driving users to other solutions. Snap has no GUI, where clearly a solution that provides a general sandbox should. When you open an app and click "Open File", the sandbox GUI should intervene and ask the user where the app is allowed to look. Also, the idea of "security bolted on top" of an existing OS doesn't seem very trustworthy.