Sebastian Wick on Nostr: npub19laga…phm4g And one thing that has been problematic in the desktop world is ...

npub19lagad90ncl2ryqvgctg84wal4mus8wznx950a0trhw85lnflucquphm4g (npub19la…hm4g) And one thing that has been problematic in the desktop world is the fact that flatpak doesn't allow for sub-sandboxing which destroys the security measures of e.g. web browsers. We also can't track e.g. when an app like steam starts a sub-app. A big reason for all of that is that we don't mount cgroupfs and don't allow namespaces so that we can inspect /proc/$PID/root/.flatpak-info (yes, we can mitigate the race).