3 ms·
The proposed solution uses security policies to block/allow APIs. However, the problem is accurately figuring out such policies, not to forget the painstakingly
by kjok 3y ago
The proposed solution uses security policies to block/allow APIs. However, the problem is accurately figuring out such policies, not to forget the painstakingly time consuming process behind it.
- tln 3y agoThe author is clearly aware of the problems... the TUI for setting up and maintaining the policies looks very efficient to use! Very impressive stuff
- ghusbands 3y agoNote that the process described in the post is a better experience than other block/allow interfaces, because you _can_ specify per library what things it can or can't access. You aren't forced to specify everything at the process or user level, where it can be harder to list or specify such things. There will still be the possibility of confused deputy attacks, but it still looks like a significant improvement to supply chain security.