kernc

> executes outside the sandbox

Now, why would anyone do that? (Like everyone and their brother) I wrote my own simple Linux/shell-based sandbox [1] (I can trust ...) and am successfully running PyCharm whole inside it ...

[1]: https://github.com/sandbox-utils/sandbox-run

The convergence is ongoing. We are Borg. You will be assimilated.

Why would they care to empower competitors?

`sandbox-venv` is a small shell script that sandboxes Python virtual environments in separate Linux namespaces using Bubblewrap (and soon using only command `unshare`, bringing the whole script down to effectively 0 deps).

https://github.com/sandbox-utils/sandbox-venv

Did you also manage to enable menu icons?

Let everyone be reminded how joyful GIMP 2.10 menus used to look ...

https://i.imgur.com/nVyMQBt.png

Probably not. Maybe Bubblewrap and sandbox-run. It's an anything-is-already-way-better-than-nothing type of thing.

[0]: https://github.com/containers/bubblewrap

[1]: https://github.com/sandbox-utils/sandbox-run

As a heads up and affirmation that the approach is correct, here's a small shell bubblewrap wrapper that boils the command line down to `sandbox-run claude --dangerously-skip-permissions`.

https://github.com/sandbox-utils/sandbox-run

Other actionable insights are:

- Merge amendments up into the initial prompt.

- Evaluate prompts multiple times (ensemble).

It being deprecated and all, didn't feel like wrapping it, but macOS supposedly has a similar `sandbox-exec` command ...

> Linux-only

What other dev OSs are there?

> once privileges are dropped [...] it doesn't appear to be possible to reinstate them

I don't understand. If unprivileged code could easily re-elevate itself, privilege dropping would be meaningless ... If you need to communicate with the outside, you can do so via sockets (such as the bind-mounted X11 socket in one of the readme Examples).

Since everyone tends to present their own solution, I bid you mine:

    sandbox-run npx @anthropic-ai/claude-code

This runs npx (...) transparently inside a Bubblewrap sandbox, exposing only the $PWD. Contrary to many other solutions, it is a few lines of pure POSIX shell.

https://github.com/sandbox-utils/sandbox-run

I wrote myself a handy and generalized bwrap-wrapping script: https://github.com/sandbox-utils/sandbox-run

No.1: Run untrusted code in a sandbox! https://github.com/sandbox-utils/sandbox-venv

Now that everyone is kindly on board, IBM can finally bury this standard. /s

What are the reasons for Snapchat? :.

> alias npm=...

I use sandbox-run: https://github.com/sandbox-utils/sandbox-run

The above simple alias may work for node/npm, but it doesn't generalize to many other programs available on the local system, with resources that would need to be mounted into the container ...

Local-first (on Lunix), POSIX shell: https://github.com/sandbox-utils/sandbox-run

A simple zero-config alternative using Linux-native containers seems to be sandbox-venv [1] for Python and sandbox-run [2] for npm ...

[1]: https://github.com/sandbox-utils/sandbox-venv [2]: https://github.com/sandbox-utils/sandbox-run

> This might be a red flag for Persona service itself as it might contain serious flaws and security vulnerabilities that Cyber criminals are relying on

Persona seems to rely solely on NFC with a national passport/ID, so simply stolen documents would work for a certain duration ...

You can use special a Unicode strikethrough glyphs such as available in https://efck-chat-keyboard.github.io

Is exactly why I composed bubblewrap-based sandbox-venv for Python: https://github.com/kernc/sandbox-venv

Dangerous times we live in.

Too personal to share, but maybe too personal and important to share even with the members of the cloudy cartel, i.e. the Providers. Is exactly why I wrote myba that does full contents and paths encryption before syncing with the lapsable remotes ...

https://kernc.github.io/myba/

Some things are better public. Some are not ...

The intricacies of Borg are exactly why I switched over to a wrapper around pure git: https://kernc.github.io/myba/

Make your own backup system—is exactly what I did. I felt git porcelain had a stable-enough API to accommodate this popular use case.

https://kernc.github.io/myba/

Indeed, more repos should add a SLOC (e.g. ghloc) badge! Give you a feel for what you're working with.

https://github.com/pajecawav/ghloc-web#badges

SAMBO does a good job of finding the global optimum in a black-box manner even compared to Nelder-Mead, according to its own benchmark ...

https://sambo-optimization.github.io

What you appear to be missing is a "symbols view / pane". Most IDEs have that!

https://www.google.com/search?q=ide+symbols+pane&tbm=isch

Building upon 40+ year old, stable technology that, compared to Wayland, still seems to be in popular demand [1, 2] is the only sensible thing for the lazy maintainer/dev. That's how I felt when I wrote X11-compatible EF*CK emoji keyboard [3].

[1]: https://qa.debian.org/popcon-graph.php?packages=xserver-xorg...

[2]: https://qa.debian.org/popcon-graph.php?packages=libwayland-s...

[3]: https://efck-chat-keyboard.github.io