3 ms·

I've never thought about surfing in a VM before, but it seems that if you're ultra paranoid that it would be best to do so. Starting to think that running apps

by tonyhb 12y ago

I've never thought about surfing in a VM before, but it seems that if you're ultra paranoid that it would be best to do so. Starting to think that running apps within a container is the right way to go.

pfraze 12y ago
Qubes tries to build the OS that way. https://www.qubes-os.org/ https://www.qubes-os.org/
alex_anglin 12y ago
Or on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on. It's turtles all the way down.
- gpmcadam 12y ago
  That's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box. ... Unplugged from the mains.
- ufmace 12y ago
  IMHO, the bigger concern is the exploits that the wider community hasn't found yet. How many nasty tricks were out there in Stuxnet for years before anybody noticed? Just given the scale of the stuff that's been found, I'm inclined to think that trying to out-secure organizations with that kind of resources is a losing battle. You're better of not being somebody anyone would invest that kind of effort to hack. Or at least making your traffic not identifiable as somebody that your opponent would want to hack. Last I checked, holders of large amounts of Bitcoin tend to avoid letting their identity be associated with their accounts easily, and that's probably why. I bet somebody would be willing to risk a few $100k exploits to get a few $million worth of BTC.
slantedview 12y ago
See Sandboxie
pcwalton 12y ago
> Starting to think that running apps within a container is the right way to go. If you're talking about something like Linux containers, note that the Chrome Pwn2Own exploit involved a sandbox escape via a kernel exploit. (Though seccomp-BPF mitigates this to some extent on Linux.)

by tonyhb 12y ago

pfraze 12y ago

Qubes tries to build the OS that way. https://www.qubes-os.org/ https://www.qubes-os.org/

alex_anglin 12y ago

Or on a completely separate machine: Exploits have been found for visualization software. Of course, then you need to be concerned about the network and so on. It's turtles all the way down.

gpmcadam 12y ago
That's why I have a separate machine which I use just for browsing the Web, which I keep disconnected from the Internet in a sealed steel box. ... Unplugged from the mains.
ufmace 12y ago
IMHO, the bigger concern is the exploits that the wider community hasn't found yet. How many nasty tricks were out there in Stuxnet for years before anybody noticed? Just given the scale of the stuff that's been found, I'm inclined to think that trying to out-secure organizations with that kind of resources is a losing battle. You're better of not being somebody anyone would invest that kind of effort to hack. Or at least making your traffic not identifiable as somebody that your opponent would want to hack. Last I checked, holders of large amounts of Bitcoin tend to avoid letting their identity be associated with their accounts easily, and that's probably why. I bet somebody would be willing to risk a few $100k exploits to get a few $million worth of BTC.

slantedview 12y ago

See Sandboxie

pcwalton 12y ago

> Starting to think that running apps within a container is the right way to go. If you're talking about something like Linux containers, note that the Chrome Pwn2Own exploit involved a sandbox escape via a kernel exploit. (Though seccomp-BPF mitigates this to some extent on Linux.)