Hacker Newsnew | past | comments | ask | show | jobs | submit | wolfi1's commentslogin

well, if you happen to be in a 'rm -Rf /' situation (which with agentic AI seems to be more often the case) to know how to operate in a chroot environment could be helpful

ah, those were the days, when compiling the kernel took about 12 hours, or the switch from COFF to elf - fun times indeed

Indeed.

I was a wuss and waited for a CD. I doged the 98 floppy install....


could xhost(1) help here?

I think the only possibility that comes to mind is creating an ebpf module that sandboxes all filesystem calls and trampolines all ld_open calls.

But then you would have to provide massive amounts of patched/"safe" variants of all kinds of shared libraries which is unfeasible.

But I mean in the xorg use case it would be possible to just provide your own library that fakes the expected returns and sends fake data to the sandboxed applications.

I did a similar thing with barrier (though using LD_PRELOAD, see [1]) on my debian system to force a different behavior.

Source: Am kind of experimenting with ebpf a lot for that use case. C ABIs and SO files are a mess though. A real messy mess.

[1] https://github.com/cookiengineer/barrier-disable-dpms


Not really - it's not sufficiently fine-grained and, besides, you need it to connect to X to display anything.

There were various attempts to improve this situation in the early 2010s, typically using Xnest or Xephyr in conjunction with other sandboxing techniques. I believe Qubes OS followed that approach but it was awkward, limited, had major performance problems, and yet never managed to fully prevent circumvention.

The fact is that the X model was never designed with these threats in mind.


> I believe Qubes OS followed that approach but it was awkward, limited, had major performance problems, and yet never managed to fully prevent circumvention.

Not sure what you are talking about. Qubes offers reliable protection with decent performance, unless you work with graphics. See also: https://news.ycombinator.com/item?id=49678250


but sandboxing would be quite useless

How so? If you can break out of a sandbox then by definition it is not a sandbox.

There are ways to force sandbox jail. For instance, giving processes only a partial view of the computer system. GoboLinux did this years ago via ViewFS (https://linuxphilia.blogspot.com/2009/07/gobolinux-is-linux-... search for ViewFS). There are many other similar solutions, some probably better.


X itself is the problem here, not the process attached to

You need to sandbox X11 which requires giving up X11 capabilities just like Wayland did.

production symptom? is this equivalent to "kidney disappointment"?

I hope one of them is Doctor Strangelove

ooh good call, I should fix that.

will Openai or Anthropic rename themselves to Skynet?

Nah. Collossus and Guardian.

not only in Sweden, in Germany and Switzerland as well. I guess it has the same origins in the trade unionist purchasing cooperatives at the turn of the century from the 19th to the 20th

At least in Germany, it's pronounced co-op, though. The stores got rebranded meanwhile. https://www.coop.de/coop/historie/

Italy, UK... Yep.

do they? there are reports of lost sheep which when found had a very thick fur or whatever the shepherds call it

Sorry, when I said in nature, I meant undomesticated sheep.

Domesticated sheep that get lost for a while don't magically learn how to shed their coat, yes.


Pretty much all domesticated sheep will cast their fleeces.

There are some breeds that don't, and obviously due to random genetics you'll get individuals that don't.

Sheep that don't cast their fleeces are damn near impossible to shear and are mostly kept for meat. Likewise, sheep that don't have much of a "rise" (see my other comment) and are difficult to shear quite often, uh, don't have a particularly long career, as it were.


Man shearing this one is a pain in the a$$. Hand me the sticking knife ...

Well, not quite, but it's one you're going to cull out at the end of the year when it's time for them to go to market.

And of course, the only truly stockproof sheep enclosure is a deep freeze.


>Also.. uh.. isn't this.. good? I thought AI was to steal all our jobs. the problem is, the CEOs still think AI solves their problems ie minimize paid jobs

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: