Item — HN Reader

"Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them.

> I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily.

I don't. My standard operating practice is to virtualize them.

My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.

2 comments

You should make a browser for you, like a QubesOS browser. Do you use QubesOS? If not, you should.

But you can't lock down everyone else's general-purpose computers just because you are more careful than the average. You're supporting the big corporations in the war against general-purpose computing here.

What do you use for virtualization for tools from developer repositories? Run them in a VM or sandboxing like bubblewrap?

QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me.

I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need.

I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents.

https://github.com/matheusmoreira/virtdev

The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it.

You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization.

https://news.ycombinator.com/item?id=49239751

Before I made all this, I used to use firejail.