Why everyone needs to know some coding: last-mile sandboxing
summary
Presents a model for sandboxing untrusted programs by replacing browsers’ hard-coded, coarse-grained protections with declarative, fine-grained policies that are applied per syscall. Describes an implementation in a Lua fork for text-mode apps where the browser ships default policies but lets users progressively own and edit small, side-effect-free policy programs; covers the rationale, past browser approaches, and the user-education challenges of making people write and maintain these policies safely.
AI-written summary · about
related talks
11mWhat your browser can teach you about software security
47mSecure Sandboxing in a Post-Spectre World
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
50mLinux Security and How Web Browser Sandboxes Really Work
38mSandboxing in Linux with zero lines of code
01h 25mSandboxing a Linux Application
37mSandboxing Applications with Landlock
30mSandboxing Agentic AI With LSM-BPF