> it doesn't have any kind of proper desktop sandboxing architecture that really works.

Bubblewrap works.

mike_hearn 4 hours ago | parent | next [-]

Bubblewrap is a less powerful version of sandbox-exec, but the macOS architecture is much larger than just that. In effect macOS runs everything under bubblewrap, in such a way that users don't notice but apps are meaningfully sandboxed and root exploits barely matter.

▲

bigyabai 4 hours ago | parent [-]

So you're retracting your claim that Bubblewrap doesn't exist/work?

▲

mike_hearn 4 hours ago | parent [-]

Bubblewrap isn't a sandboxing architecture, so no. Go look at how Apple designed the macOS/iOS security system and you'll see that a Bubblewrap like tool is only. small portion of it.

	▲	bigyabai 4 hours ago \| parent [-]
		Linux in-general is a small portion of the Darwin architecture. One is a monolithic kernel, the other has microkernel IPC security to consider. Are there any glaring limitations in Bubblewrap you'd like to point out, or are we having the Tannenbaum argument all over again?

▲

graemep 4 hours ago | parent | prev [-]

and Firejail

	▲	oever 4 hours ago \| parent [-]
		and sydbox