Hacker News Reader

Java applets died primarily due to the terrible user experience and inconsistent browser support. Security issues were less of a factor.

To be fair the entire approach was flawed and should have been abandoned in favour of SELinux plus something like seccomp years before.

Selinux, apparmor, etc. are not viable security solutions for pretty much anything, because they are too coarse grained. Seccomp that blocks everything, but leaves just a couple of syscalls to interact with an external proxy process is closer to what could have worked, which is basically a sandbox.

How do you feel about openbsd's pledge()? I would really like something as simple as that on linux...

seccomp actually has that ability to allow only small portion of selective operations.

Block everything except io is just one of its blocking mode.

And the list is even configurable. Docker do use such ability to filter out sys-calls that shouldn't be used in the container.

Sun...