Hacker News Reader

It may be in the future, but for now it is no different from Fedora Workstation in terms of security. Please correct me if I am wrong. AFAIK Silverblue has no additional sandboxing or any other improvements to security.

View on HN

Pretty sure Fedora, being based on Red Hat, has the strongest SELinux policy in place by default, and SELinux is pretty much the best sandboxing option available other than actual virtualization.

Yes, but this was about Silverblue and how it implements some additional sandboxing, which it doesn't. SELinux is great, but maintaining it and creating configs is huge amount of work and where on AOSP, every process is strictly confined with SELinux, on Fedora, not so much. Not to mention the additional software the user installs. Not at all comparable to real Android or iOS sandboxing.

Secureblue has entered the chat.

It's generally only initial work to make the policies to maintain a program, maintaining doesn't even really exist unless the program radically changes in some way.

Fedora is notable because any software installed via repositories has a policy written for it, so it is already far more in effect than you might realize.

It's entirely comparable to Android sandboxing because it's part of the foundation of Android sandboxing.

Reply on news.ycombinator.com