4 ms·
Yep. And it gets worse. Websites are at least supposedly sandboxed so they are not as much of a risk as running native binaries. But this is getting worse and
by superkuh 2y ago
Yep. And it gets worse.
Websites are at least supposedly sandboxed so they are not as much of a risk as running native binaries. But this is getting worse and worse as browsers expose more and more of their host operating system's functionality. The benefits of using a website instead of a native app are quickly disappearing while the drawbacks have only been somewhat mitigated. We're getting to the point where browsers are worthy of the decades old criticism Emacs has received. They have eventually become an OS with many fine features - simply lacking a good web browser.
The browser, and the web, has been destroyed by the insane security model of modern OS-Browsers: running every executable they're sent from anyone with not a care in the world as if it is normal. This one thing has made it so browsers cannot be in control of the user, made it so that CA TLS is pretty much required and so that browser devs write entirely for the security use cases of the insane corporate web applications instead of writing for human people looking at website documents.
And this same security model makes it so that web apps basically cannot communicate with each other at all, unlike real applications where piping between small applications is the entire idea.
- watermelon0 2y agoMobile operating systems have really good security models, and native apps are even more isolated compared to the websites. I really wish that we would have similar isolation options on desktop/laptop OSes.
- add-sub-mul-div 2y agoIt would be horrible if we lost desktop computing to a scenario where we need permission from one of the tech giants before running code. Those who sacrifice freedom for security deserve neither.
- superkuh 2y agoYou can use Qubes OS (a linux that relies heavily on virtualization) if you want that.
- rejhgadellaa 2y agoI'm afraid it's the other way around. Browsers are (generally) better at sandboxing than OSs. Browsers are paranoid by default. They have to be, because visiting a website is just a click away (compared to multiple clicks/taps to install a native app). For example, Chromium was able to mitigate Meltdown/Spectre within days, even if the OS was still vulnerable. (Chrome already had site isolation ready to ship, a feature that completely isolates websites into their own process). Even better, Chromium browsers tend to update themselves (or via Google Play) automatically. Meanwhile, OS vendors were scrambling to ship an OS update. (Also, worth mentioning that iOS users were vulnerable until Apple shipped an OS update, because every browser on iOS has to use Apple's WebKit)