Top all-time · #3520
l3net
Personal blog · l3net.wordpress.comsystemsprogramming
l3net is a personal blog at l3net.wordpress.com about systems and programming. Since 2013, 22 different Hacker News readers have linked it 41 times, most often “Sandbox for Firefox”. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for Firejail, its sandboxing tool for running desktop apps like browsers in Linux namespaces. Other linked posts cover containers, LXC networking and desktop memory use.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A blog about IP networking, network and system administration, Linux/UNIX programming and testing. The blog also includes some small projects I run in my free time.
Most-linked posts?
- Sandbox for Firefox5 people · 5 mentions · first linked 2015-02-07
- Firejail – A Security Sandbox for Mozilla Firefox, Part 13 people · 3 mentions · first linked 2015-03-29
- Firejail – Simple Linux sandbox with seccomp3 people · 3 mentions · first linked 2014-08-16
- Debian Virtualization: LXC Network Isolation2 people · 2 mentions · first linked 2013-09-03
- Lightweight Debian: LXDE Desktop From Scratch2 people · 2 mentions · first linked 2013-05-02
- Debian/Ubuntu Cross-distro Gaming with Firejail2 people · 2 mentions · first linked 2014-10-30
What Hacker News says?
Updating software shouldn't give a sense of security, instead use sandbox/cipher technologies more generalized, for firefox you could use firejail[0] or sandfox[1]. Or even more general approaches like subuser[2] or QubeOs[3]. Personally I use FF 28.x + Noscript + Adblock plus + Firejail 0.9.28-1 and I feel quite confident I won't get hacked by random attacks. [0] https://l3net.wordpress.com/2014/09/19/firejail-a-se…
Comment linking /2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/
on “Firefox exploit found in the wild”Submitted A Memory Comparison of Light Linux Desktops as a story · 101 points
HN discussionIt can be with Firejail: https://l3net.wordpress.com/projects/firejail/
Comment linking /projects/firejail/
on “Firefox exploit found in the wild”Submitted A Memory Comparison of Light Linux Desktops as a story · 79 points
HN discussionThe new Firejail app [1] may be worth exploring as it is designed to run locally installed apps like browsers and games in sandboxes, as opposed to more chroot oriented container managers like LXC, Docker or Nspawn. They all use namespaces. If you want to use a chroot oriented container manager its better to use an unprivileged container so you are not running as root. Currently only LXC has support for unprivileged…
Comment linking /projects/firejail/
on “Firefox exploit found in the wild”Submitted Firejail – Simple Linux sandbox with seccomp as a story · 62 points
HN discussionwe can get better compartmentalization than that with things like user namespaces (firejail[1]) or spawning a temporary user id[2] [1] https://l3net.wordpress.com/projects/firejail/ [2] https://github.com/teran-mckinney/raru
Comment linking /projects/firejail/
on “Detecting the use of “curl – bash” server side”Submitted Debian Virtualization: LXC Network Isolation as a story · 45 points
HN discussion> Lastly, lightweight containers are the real-deal for small development tasks (not for production!). Just one command: systemd-nspawn, and you're ready to go. You might be interested in firejail [1]. It makes finer-grained use of Linux namespaces, and doesn't depend on systemd (or much of anything, for that matter). [1] http://l3net.wordpress.com/projects/firejail/
Comment linking /projects/firejail/
on “Why systemd?”Submitted Freejail: a Linux security sandbox as a story · 5 points
HN discussionThanks for the feedback and alternatives, I hadn't seen Spoon or LXD yet so I'll check those out. Namespaces are sometimes supported directly by the application itself, for example uWSGI, and anything lacking native support you can use firejail [1]. There is also an article [2] by an OVH employee about using namespaces directly in C. [1]: https://l3net.wordpress.com/projects/firejail/ [2]: https://blog.jtlebi.fr/201…
Comment linking /projects/firejail/
on “Let's review Docker”Submitted Sandbox for Firefox as a story · 4 points
HN discussionFirejail anyone? http://l3net.wordpress.com/projects/firejail/
Comment linking /projects/firejail/
on “Running GUI apps with Docker”Submitted Firejail – A Security Sandbox for Mozilla Firefox, Part 1 as a story · 4 points
HN discussionYou could use firejail[1]. [1]: https://l3net.wordpress.com/2014/09/19/firejail-a-security-s...
Comment linking /2014/09/19/firejail-a-security-sandbox-for-mozilla-firefox/
on “Firefox Under Fire: Anatomy of latest 0-day attack”Submitted Lightweight Debian: LXDE Desktop from Scratch as a story · 4 points
HN discussionI've been using Firejail for this purpose: http://l3net.wordpress.com/2014/04/16/how-to-restrict-a-logi...
Comment linking /2014/04/16/how-to-restrict-a-login-shell-using-linux-namespaces/
on “Dockersh – a shell that puts users into individual docker containers”Submitted Debian Virtualization: LXC Desktop Virtualization as a story · 4 points
HN discussionLink for the lazy: https://l3net.wordpress.com/2013/03/17/a-memory-comparison-o... Also covers XFCE, awesome, *box, etc.
Comment linking /2013/03/17/a-memory-comparison-of-light-linux-desktops/
on “A Memory Comparison of Light Linux Desktops”Submitted Lightweight Debian: LXDE Desktop From Scratch as a story · 4 points
HN discussionThis is a nice blog post about isolating your container network stack using LXC: http://l3net.wordpress.com/2013/08/25/debian-virtualization-...
Comment linking /2013/08/25/debian-virtualization-lxc-network-isolation/
on “LXC 1.0 Released”Submitted Debian/Ubuntu Cross-distro Gaming with Firejail as a story · 3 points
HN discussionhttps://l3net.wordpress.com/2014/09/19/firejail-a-security-s... https://l3net.wordpress.com/2015/02/19/firejail-a-security-s...
Comment linking /2015/02/19/firejail-a-security-sandbox-for-mozilla-firefox-part-2/
on “Ask HN: Best Linux sandbox?”Submitted Fedora Memory Comparison as a story · 3 points
HN discussionSubmitted How to Package and Publish an Open Source Project as a story · 3 points
HN discussionSubmitted Ubuntu Desktop Memory Comparison as a story · 3 points
HN discussionSubmitted Debian Virtualization: LXC Application Containers as a story · 3 points
HN discussionSubmitted Firejail Linux Capabilities Guide as a story · 2 points
HN discussionSubmitted Firejail – A Security Sandbox for Mozilla Firefox as a story · 2 points
HN discussionSubmitted Lightweight Debian: LXDE Desktop From Scratch as a story · 2 points
HN discussion