Hacker News Reader

Most of your comment it's bullshit. Containers are not for security, but for convencience and task separation/isolation to avoid the overhead of a vm. eBPF will expose you further more, not less. Also, how can flatpak secure you against a ~/.profile script run at login or an ~/.xprofile one?

View on HN

A malicious program is going to have a difficult time adding something to your ~/.profile script if it cannot access your home directory. Although I don't doubt that many flatpak programs have too lenient default permissions, and the various XOrg lack of isolation issues are unfortunate somewhat remedied in wayland.

OpenBSD is implementing Wayland if you like it instead of Xenocara.

Again, in which way it's any GNU/Linux distro better then?

See: https://www.openbsd.org/papers/eurobsdcon2023-matthieu-wayla...

Wayland does not stop a process from manipulating the home directory, doing various things on the network, using a ton of memory, recording what other processes exist etc. Once you add all that stuff you start to get something that looks a lot like containers.

OpenBSD has limits.conf and acct(8). Again, RTFM.

Obviously OpenBSD has some limited mechanisms for managing RAM usage and open file descriptors, just like every other system.

Reply on news.ycombinator.com