3 ms·
Most of your comment it's bullshit. Containers are not for security, but for convencience and task separation/isolation to avoid the overhead of a vm. eBPF will
by anthk 3y ago
Most of your comment it's bullshit. Containers are not for security, but for convencience and task separation/isolation to avoid the overhead of a vm. eBPF will expose you further more, not less. Also, how can flatpak secure you against a ~/.profile script run at login or an ~/.xprofile one?
- harporoeder 3y agoA malicious program is going to have a difficult time adding something to your ~/.profile script if it cannot access your home directory. Although I don't doubt that many flatpak programs have too lenient default permissions, and the various XOrg lack of isolation issues are unfortunate somewhat remedied in wayland.
- anthk 3y agoOpenBSD is implementing Wayland if you like it instead of Xenocara. Again, in which way it's any GNU/Linux distro better then? See: https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayland-openbsd.pdf https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayla...
- harporoeder 3y agoWayland does not stop a process from manipulating the home directory, doing various things on the network, using a ton of memory, recording what other processes exist etc. Once you add all that stuff you start to get something that looks a lot like containers.
- anthk 3y agoOpenBSD has limits.conf and acct(8). Again, RTFM.
- harporoeder 3y agoObviously OpenBSD has some limited mechanisms for managing RAM usage and open file descriptors, just like every other system.