5 ms·

You can't do anything about a compromised app or JS from a random website. I always find it weird when people attack Wayland's security model, more isolation is

You can't do anything about a compromised app or JS from a random website. I always find it weird when people attack Wayland's security model, more isolation is obviously a great idea, as demonstrated by supply chain attacks in the recent decade. It's that Wayland's design, implementation, their attitude, and everything else about it is terrible. It could have been implemented without compromising on features or convenience by explicitly specifying minimalistic controlled side channels in their security model from the start, instead of shifting it onto ad-hoc implementations. And of course the windowing system is already too large of an attack surface. Many people are thinking about going full Qubes due to the current realities, while the others live in denial and call even window isolation "paranoia". Fascinating.

chadgpt3 5mo ago
Turn off the web browser feature that allows JS in an advertisement in a background tab to globally grab your input.
- orbital-decay 5mo ago
  Sure, browsers had three decades of adversarial testing to evolve into sandboxes, but what are you going to do in case of something like the xz backdoor in a desktop application? It's no longer a hypothetical in 2020s.
  - chadgpt3 5mo ago
    You're going to be hacked. There's no useful middle ground between letting programs modify how your computer works and not letting programs modify how your computer works.
    - orbital-decay 5mo ago
      Of course there is: fine-grained access control and attack surface reduction. It's not all or nothing.
      - chadgpt3 5mo ago
        Do you want to see the dancing bunnies? [Yes] [No] Apple apologists keep making the excuse that Apple has to provide no side loading because if there was any single way to do it, all scammers would be making all grandmas do that. They're correct.
        orbital-decay 5mo ago
        That's a complete strawman though, I'm not talking about any of that.

chadgpt3 5mo ago

Turn off the web browser feature that allows JS in an advertisement in a background tab to globally grab your input.

orbital-decay 5mo ago
Sure, browsers had three decades of adversarial testing to evolve into sandboxes, but what are you going to do in case of something like the xz backdoor in a desktop application? It's no longer a hypothetical in 2020s.
- chadgpt3 5mo ago
  You're going to be hacked. There's no useful middle ground between letting programs modify how your computer works and not letting programs modify how your computer works.
  - orbital-decay 5mo ago
    Of course there is: fine-grained access control and attack surface reduction. It's not all or nothing.
    - chadgpt3 5mo ago
      Do you want to see the dancing bunnies? [Yes] [No] Apple apologists keep making the excuse that Apple has to provide no side loading because if there was any single way to do it, all scammers would be making all grandmas do that. They're correct.
      - orbital-decay 5mo ago
        That's a complete strawman though, I'm not talking about any of that.