Browsers have been sandboxing their tabs since 2008. Don't sit there and tell me that bwrap, sandboxing, whatever is some kind of recent innovation with uneven distro support.
And yes, bwrap needs root or namespaces. So what? So does sudo. Setuid binaries are as old as time.
You know what's also been around and doesn't require root? Landlock. Have you heard of it? Has anyone? There's a huge PR and visibility gap in this space. We don't have to invent some new thing. We have to get people to learn about what we already have and use it.
"Oh, the technology works, but it need setup! Oh, my distro doesn't enable it! Oh, it doesn't work out of the box with my code!"
This is a social problem. It's not a technology problem. It's people not wanting to do the work, not understanding what already exists, dismissing solutions based on non-problems (like bwrap needing privileges on some systems), and in general adopting an attitude of "no", not a can-do problem solving stance.
And we're supposed to solve this problem with let another precious little effects language or another fucking MicroVM environment? FFS.
We need unprivileged sandboxing!"
"Use bwrap"
"Nooo, that needs setuid root or file caps!!!1!1"
"So the problem is that bwrap is part of the TCB?"
"Yes. We need sandboxing that relies only on unprivileged code like the Linux kernel"
... the fuck?
You can't solve a social problem with technology.
> Browsers have been sandboxing their tabs since 2008.
Yes, it's an amazing feat that has cost billions and led to major features like seccomp v2, ptrace sandboxing, etc. Do you know the history of browser sandboxing? It's pretty complex, a major technical feat.
> Don't sit there and tell me that bwrap, sandboxing, whatever is some kind of recent innovation with uneven distro support.
I can tell you that unprivileged sandboxing is not only new, it's ongoing and nascent work and not commonplace at all.
> And yes, bwrap needs root or namespaces. So what? So does sudo. Setuid binaries are as old as time.
These are massive footguns and issues for deploying code... You don't get that? Again, implementations have tradeoffs.
> You know what's also been around and doesn't require root? Landlock.
lol it is SO NEW what the fuck dude?
> Have you heard of it? Has anyone?
Yes, I use it!
> "Oh, the technology works, but it need setup! Oh, my distro doesn't enable it! Oh, it doesn't work out of the box with my code!"
> This is a social problem.
Yeah these sound like social problems if you have literally no idea what you're talking about lmfao. IT's BOTH.
Your ignorance is blatant and your position is dead in the water.