upvote

points

by FeepingCreature5 hours ago |
comments
upvoteby matheusmoreira4 hours ago|
[-]
"Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them.

> I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily.

I don't. My standard operating practice is to virtualize them.

My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.

reply
upvoteby sersi3 hours ago|
parent|
[-]
What do you use for virtualization for tools from developer repositories? Run them in a VM or sandboxing like bubblewrap?
reply
upvoteby matheusmoreira2 hours ago|
parent|
[-]
QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me.

I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need.

I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents.

https://github.com/matheusmoreira/virtdev

The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it.

You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization.

https://news.ycombinator.com/item?id=49239751

Before I made all this, I used to use firejail.

reply