4 ms·
What kind of logic is this? It's standard in the Linux world to give important services a separate user domain.
by anvuong 3mo ago
What kind of logic is this? It's standard in the Linux world to give important services a separate user domain.
- khalic 3mo agoThe standard here is not enough when the agent can escalate by finding 0 days, for example. It’s like giving a black hat a limited account. Sure it might restrict him, but not giving him an account at all is way better
- gowld 3mo agoThe black hat can find 0-day escalation in your sandbox, too. A user account is a sandbox.
- khalic 3mo agoNot as air tight as a container Edit: it’s about the attack surface
- chrisweekly 3mo agomicrovms are better than containers running on your host. see eg the "smolvm" microvms from https://smolmachines.com https://smolmachines.com
- khalic 3mo agothanks, will take a closer look