You can't simultaneously say that we've had the tech for years and also say that it doesn't work. We have not had the tech for years. x-plat sandboxing is extremely difficult, especially in a way that's performant.

Sandboxing almost always involves having a dedicated, privileged service, due to how operating systems have designed things. It requires platform specific code.

This is a technical problem and a social problem, there's zero reason to believe it's just one.

▲

quotemstr 2 hours ago | parent [-]

The technology works fine if you use it in a disciplined way. The problem is that people don't! You're necessarily going to break programs if you put them in restricted environments. That's not the same as the restriction technology not working properly.

> Sandboxing almost always involves having a dedicated, privileged service, due to how operating systems have designed things.

Or just invoking bwrap. Or sandbox-execute. There's no performance overhead. Complexity is minimal. Just read current Codex source code. It's not so bad. People have been making these sandbox tools for AI agents for years. Just need to apply sandboxing to all domains.

You want some kind of silver bullet that makes code "safe" without anyone having to change anything? To prompt for nothing? To use no IPC portal? That's not happening.

The people saying we need a new language or something are half right. We don't need a new language. A pure library solution is fine! But people do need to do work to make an ecosystem based on capabilities and least privilege to work. And we need to tell people who refuse to do this work to go to hell.

A new language is neither necessary nor sufficient. What we need is new set of balls.

▲

insanitybit 2 hours ago | parent [-]

> The technology works fine if you use it in a disciplined way.

Then obviously we have to discuss the implementation!

> Or just invoking bwrap. Or sandbox-execute. There's no performance overhead. Complexity is minimal. Just read current Codex source code. It's not so bad. People have been making these sandbox tools for AI agents for years. Just need to apply sandboxing to all domains.

Tools like bwrap literally could not have existed until very recently without also requiring suid/ privileges, and even today unprivileged user namespaces are not universally enabled. This is why the implementation matters. No, unprivileged sandboxing has not been around for years, especially not x-plat. bwrap is a perfect example of what I'm talking about, great reference - it either requires root or it requires unprivileged user namespaces and it's not x-plat. Great.

> You want some kind of silver bullet that makes code "safe" without anyone having to change anything? To prompt for nothing? To use no IPC portal? That's not happening.

I have no idea why you think I've said this, I'm pointing out that the implementation and technology matters deeply.

> The people saying we need a new language or something are half right. We don't need a new language. A pure library solution is fine! But people do need to do work to make an ecosystem based on capabilities and least privilege to work. And we need to tell people who refuse to do this work to go to hell.

Again, you can't say "this technology has existed for years! You can do it in a library!" and then say "but they don't!". You misunderstand the complexity and assert that it's merely a matter of will. It is both.

▲

quotemstr 2 hours ago | parent [-]

Browsers have been sandboxing their tabs since 2008. Don't sit there and tell me that bwrap, sandboxing, whatever is some kind of recent innovation with uneven distro support.

And yes, bwrap needs root or namespaces. So what? So does sudo. Setuid binaries are as old as time.

You know what's also been around and doesn't require root? Landlock. Have you heard of it? Has anyone? There's a huge PR and visibility gap in this space. We don't have to invent some new thing. We have to get people to learn about what we already have and use it.

"Oh, the technology works, but it need setup! Oh, my distro doesn't enable it! Oh, it doesn't work out of the box with my code!"

This is a social problem. It's not a technology problem. It's people not wanting to do the work, not understanding what already exists, dismissing solutions based on non-problems (like bwrap needing privileges on some systems), and in general adopting an attitude of "no", not a can-do problem solving stance.

And we're supposed to solve this problem with let another precious little effects language or another fucking MicroVM environment? FFS.

We need unprivileged sandboxing!"

"Use bwrap"

"Nooo, that needs setuid root or file caps!!!1!1"

"So the problem is that bwrap is part of the TCB?"

"Yes. We need sandboxing that relies only on unprivileged code like the Linux kernel"

... the fuck?

You can't solve a social problem with technology.

	▲	insanitybit an hour ago \| parent [-]
		> Browsers have been sandboxing their tabs since 2008. Yes, it's an amazing feat that has cost billions and led to major features like seccomp v2, ptrace sandboxing, etc. Do you know the history of browser sandboxing? It's pretty complex, a major technical feat. > Don't sit there and tell me that bwrap, sandboxing, whatever is some kind of recent innovation with uneven distro support. I can tell you that unprivileged sandboxing is not only new, it's ongoing and nascent work and not commonplace at all. > And yes, bwrap needs root or namespaces. So what? So does sudo. Setuid binaries are as old as time. These are massive footguns and issues for deploying code... You don't get that? Again, implementations have tradeoffs. > You know what's also been around and doesn't require root? Landlock. lol it is SO NEW what the fuck dude? > Have you heard of it? Has anyone? Yes, I use it! > "Oh, the technology works, but it need setup! Oh, my distro doesn't enable it! Oh, it doesn't work out of the box with my code!" > This is a social problem. Yeah these sound like social problems if you have literally no idea what you're talking about lmfao. IT's BOTH. Your ignorance is blatant and your position is dead in the water.