> The real vulnerability of concern IMO is that the sandbox was so easily escaped. People lock down some syscalls and call it "sandbox", despite the fact that

> The real vulnerability of concern IMO is that the sandbox was so easily escaped. People lock down some syscalls and call it "sandbox", despite the fact that the untrusted code is still running directly on your cpu and has access to all remaining kernel interfaces. "sandbox" is a misnomer for this. It should be sth like "there is a fence over there".