I find the text harder to read, the more significant links and terms or aspects harder to identify, and the consecutive-words-links unable to identify without hovering.

I get the idea, but I think it can be done better, and if it's like this, between less and more, I prefer less - even if that means fewer references.

The advantage of an application kernel is that it reduces the access a running application has to exploit the kernel. Sure, with a VM the guest runs its own kernel. But the KVM hypervisor is still in the host's kernelspace. Implementing syscalls in userspace while using a safer subset of the kernel's syscalls helps prevent certain attacks. The performance hit is real of course. But syd has different goals than gVisor because it prevents apps from running unless they are given the permissions to do so.

Syd's architecture is similar to gvisor, mentioned in the article. It has similar tradeoffs, although I suspect it is more performant (can't find benchmarks) since it is written in rust, rather than go.

Gvisor has some significant performance hits: https://gvisor.dev/docs/architecture_guide/performance/ . microvm/cloud hypervisor/ other vm solutions, with kvm, are around a 95% performance.

I don't. Many of the terms are easily searchable, and it's frustrating to click on one of them expecting to see syd-specific documentation about a topic or usecase only to see a generic post about a login shell (one of the links). It's trivial to highlight something and then right click and "Search DuckDuckGo for "highlighted term"" (firefox right click menu) nowadays. A search for "Login Shell Linux" nets that link they put in their documentation as literally the first result.

I wish they only actually linked syd's internal documentation, maybe to stuff like the LWN articles explaining some of their design decisions

Actually some of the links are easter eggs and they are pretty funny. Those can stay ig.

Is that a bad thing? I personally like links to where I can learn more.

That's some excessive text linking in the README I've not seen before. More blue than white, and three word-links one after another.

Quite the contrast to the "only" three footnotes.

For a proper sandbox (but also not a VM) on Linux, use Sydbox (or syd-oci). Virtual machines are an obvious choice, like said in the article, but a sandbox offers less overhead. The other issue with a VM is that, while it does isolate the guest from direct access to host resources, it doesn't stop the guest from doing whatever it wants (in the guest OS). The compromised guest could still attack the host or other network attached devices. Virt guests should still be configured with least privilege using a MAC (like SELinux or SMACK), or/and a sandbox policy (like with syd-oci).

Interesting though the vulns are patched and they didn’t mention that until i clicked.

unknown attackers exploited the vulnerability to push a new version of element-data, a command-line interface that helps users monitor performance and anomalies in machine-learning systems. When run, the malicious package scoured systems for sensitive data, including user profiles, warehouse credentials, cloud provider keys, API tokens, and SSH keys, developers said. The malicious version was tagged as 0.23.3 and was published to the developers’ Python Package Index and Docker image accounts. It was removed about 12 hours later, on Saturday. Elementary Cloud, the Elementary dbt package, and all other CLI versions weren’t affected.

Maybe just maybe forums are for discourse? Or maybe you're just as at fault for trying to gatekeep, bringing the "immediately on topic" comment ratio down? Be the change you want to see in world and let it go. It's easy, start by not responding now.

I can't believe how many decades we got out of just letting all apps have full access to $HOME. In $current_year it's our own fault if we don't properly isolate our applications I guess. Android does a pretty good job of it IMO although cross-app intents probably need more protection.

👍

No but you're doing a good job fuelling the stereotype 😃

It’s going to take creds out of your browser, spawn a new one not in the browser sandbox and act as the user to complete tasks. What tasks? ¯\_(ツ)_/¯

Technically, at least as far as the author can tell, it only affects Chromium-based browsers. So Firefox would not be affected (yet).

And only on Mac so far, the app being made with ElectronOS. Not sure what Windows looks like.

I'm pretty sure I do not represent the com as an individual.

What is it with Lemmy users posting semi-unrelated comments just to make a point?

You can't post anything in the Android or GooglePixel communities without 4 "ditch Google, use Graphene" comments.

It really doesn't make for an engaging community that one wants to partake in.

While brave itself is only a minor character in this story, it is Chromium based. I was merely pointing it out. You'd be surprised how many push the brave browser on Lemmy.

Not at all surprised

to lazy to read but sounds like its related to its front end testing mcp which you would expect to have access to browser configs when needed especially for playwright

It is a bit of a nothingburger, but it's important to note that Electron apps normally bundle their own chromium instance within itself and don't use other browsers. I suspect this is done to potentially support working directly with browsers you have installed.

What's Brave got to do with this? The article (that you didn't read) goes into detail about how Anthropic places these files in the directory for any Chromium-based browser.