4 ms·

The problem is that sandboxing is an afterthought on these platforms.

withinboredom 3y ago
That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quite different, and be much slower. Just look at how slow mobile OS's are, despite being on ridiculously fast hardware. My Palm Pilot in 1998 felt faster and more responsive than most devices today. Android devices essentially require a human to manage the memory because starting just a few apps uses almost all of it. Even iOS devices can only run a few apps before it starts killing things. Sandboxing has an extremely high cost (with not much to gain), so high that even on modern hardware you start running into physical limits very quickly: memory, disk space, and processing power. Until we can properly share resources in sandboxed apps (or increase the physical limits of the hardware) to a certain point, it just doesn't make sense to only be able to run a few things on a desktop machine.
- nolist_policy 3y ago
  Performance has absolutely nothing to do with sandboxing. Heck you could already apply many sandboxing techniques with Linux 0.x by chroot() to an empty directory followed by setuid() to "nobody". If that process needs file access, fork() a broker process before the chroot() that funnels file descriptors over an unix socket to the sandboxed process. The broker strictly checks file access permissions of course or could even present the file open dialog to the user. This is next to no overhead in many cases (keep in mind you'll stat/open/mmap a bunch of .so's anyways on startup), except for the fork() maybe. And that can be fixed by proper sandboxing API's by the OS. The problem is that these OS's give the processes to much permissions in the fist place (access to all the user's files, ...).
  - michaelt 3y ago
    > Performance has absolutely nothing to do with sandboxing. In theory, sure. In practice, when Ubuntu added a sandbox to the calculator it started taking longer to start than Eclipse. Took them about 4 years to fix it.
    - pjmlp 3y ago
      More a matter of execution than the technology. Sandboxing and virtualization existed in mainframes and micros already for decades, and were originally made available in UNIXes like Tru64 and HP-UX Vaults.
  - josefx 3y ago
    > Performance has absolutely nothing to do with sand boxing. Even simple optimizations like shared caches fall afoul of proper isolation. In the past browser caches could be abused to find out if a user frequented specific sites just by checking how long it would take to request a site specific resource. Result: no more shared caching, all resources had to be loaded for each site separately.
- gizmo 3y ago
  Every time a user space program makes an syscall the OS already has to go through layers of indirection. The OS can provide a program with a virtual or restricted view of the filesystem instead of the real thing just as easily. The OS already prevents processes from accessing each other's memory. There are some difficulties with sandboxing peripherals and GPU access, but for the most part sandboxing has absolutely no performance impact. Sandboxing doesn't mean the OS has to spin up a virtual machine every time you want to run a program.
- Y_Y 3y ago
  The sun is white though.
  - bmicraft 3y ago
    White is quite a flexible term. The suns (color) temperature is 5778K.
    - Y_Y 3y ago
      That's a weirdly precise measurement of the temperature of sunlight. Colour temperature isn't really a precise way of measuring colour since not even a body like the sun really acts as a black body emitter. All that said, colour temperatures around six thousand kelvins are certainly describable as white and not as yellow.
      - marcosdumay 3y ago
        The Sun is an almost perfect black body emitter. Outside of our atmosphere, it's perfectly so, and the atmospheric distortion is imperceptible. Any reasonable representation of its color would classify the Sun as white, except when comparing it to other stars, where the small differences matter a lot.
        Y_Y 3y ago
        Maybe you are more forgiving than I am, but the spectrum of the sun even measured from nearby in space is distinctly different to a Planck spectrum[0]. [0] https://www.e-education.psu.edu/meteo300/node/683 https://www.e-education.psu.edu/meteo300/node/683

That is obvious. Like saying the "sun is yellow because it is about 4.5 billion years old." Even if sandboxing was thought about back when Linus was porting Unix, it would have been extremely slow as processors and ram was very limited back then. If we could go back in time and give them ridiculously fast processors and effectively unlimited ram like we have today, I'm sure Linux and Windows (er, DOS) would look quite different, and be much slower. Just look at how slow mobile OS's are, despite being on ridiculously fast hardware. My Palm Pilot in 1998 felt faster and more responsive than most devices today. Android devices essentially require a human to manage the memory because starting just a few apps uses almost all of it. Even iOS devices can only run a few apps before it starts killing things. Sandboxing has an extremely high cost (with not much to gain), so high that even on modern hardware you start running into physical limits very quickly: memory, disk space, and processing power. Until we can properly share resources in sandboxed apps (or increase the physical limits of the hardware) to a certain point, it just doesn't make sense to only be able to run a few things on a desktop machine.

nolist_policy 3y ago
Performance has absolutely nothing to do with sandboxing. Heck you could already apply many sandboxing techniques with Linux 0.x by chroot() to an empty directory followed by setuid() to "nobody". If that process needs file access, fork() a broker process before the chroot() that funnels file descriptors over an unix socket to the sandboxed process. The broker strictly checks file access permissions of course or could even present the file open dialog to the user. This is next to no overhead in many cases (keep in mind you'll stat/open/mmap a bunch of .so's anyways on startup), except for the fork() maybe. And that can be fixed by proper sandboxing API's by the OS. The problem is that these OS's give the processes to much permissions in the fist place (access to all the user's files, ...).
- michaelt 3y ago
  > Performance has absolutely nothing to do with sandboxing. In theory, sure. In practice, when Ubuntu added a sandbox to the calculator it started taking longer to start than Eclipse. Took them about 4 years to fix it.
  - pjmlp 3y ago
    More a matter of execution than the technology. Sandboxing and virtualization existed in mainframes and micros already for decades, and were originally made available in UNIXes like Tru64 and HP-UX Vaults.
- josefx 3y ago
  > Performance has absolutely nothing to do with sand boxing. Even simple optimizations like shared caches fall afoul of proper isolation. In the past browser caches could be abused to find out if a user frequented specific sites just by checking how long it would take to request a site specific resource. Result: no more shared caching, all resources had to be loaded for each site separately.
gizmo 3y ago
Every time a user space program makes an syscall the OS already has to go through layers of indirection. The OS can provide a program with a virtual or restricted view of the filesystem instead of the real thing just as easily. The OS already prevents processes from accessing each other's memory. There are some difficulties with sandboxing peripherals and GPU access, but for the most part sandboxing has absolutely no performance impact. Sandboxing doesn't mean the OS has to spin up a virtual machine every time you want to run a program.
Y_Y 3y ago
The sun is white though.
- bmicraft 3y ago
  White is quite a flexible term. The suns (color) temperature is 5778K.
  - Y_Y 3y ago
    That's a weirdly precise measurement of the temperature of sunlight. Colour temperature isn't really a precise way of measuring colour since not even a body like the sun really acts as a black body emitter. All that said, colour temperatures around six thousand kelvins are certainly describable as white and not as yellow.
    - marcosdumay 3y ago
      The Sun is an almost perfect black body emitter. Outside of our atmosphere, it's perfectly so, and the atmospheric distortion is imperceptible. Any reasonable representation of its color would classify the Sun as white, except when comparing it to other stars, where the small differences matter a lot.
      - Y_Y 3y ago
        Maybe you are more forgiving than I am, but the spectrum of the sun even measured from nearby in space is distinctly different to a Planck spectrum[0]. [0] https://www.e-education.psu.edu/meteo300/node/683 https://www.e-education.psu.edu/meteo300/node/683