Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Can I use this as a generic app permissions boundary or do I have to somehow fake it as an "agent"? We are well past the point where I need to be able to lock down that my music player has no ability to read my SSH keys or whatever.

    Naturally, this will be gated to corporate customers - the plebs do not get access to better security unless they pay for a top tier license.

    by 3eb7988a1663
  • I thought this was going to be Microsoft's version of docker.
    by okeuro49
  • I'd give it a whirl, but wiped my last windows machine a year ago precisely because stuff like this "just works" on linux. VM, containers, process containment all have matured options and have for years
    by Havoc
  • I've tried it, it's not a 1.0 release. This is more like an early tech preview.
    by andix
  • What are these people running from? They're not! They're running to the world's toughest competition in town!
    by DeepYogurt
  • The biggest news - and the most welcome one - is that W11 25H2 August cumulative update now allows anyone to set up App containers without administrative privileges. Then they built mxc on top of that.

    This is a first step: uncertain, unstable, with many improvements to build upon; but always a step, enabling pioneers out there to explore something new.

    Thanks for sharing!

    by nilleb
  • Sadly, skimming the docs about how the different backends work makes me think that almost this entire project was done by a recent-gen LLM that interpreted its instructions as “make these things work at all costs” instead of “make a considered design that cleanly and securely fits its use case”.

    Even the bubblewrap integration docs are basically a stream of consciousness vibe splat. I have approximately zero confidence in the results.

    (reposted from the other copy of basically this post: https://news.ycombinator.com/item?id=50026061)

    by amluto
  • I’ve had a good think about this, and while it’s good to see them finally answering bubblewrap, the truth is that we as an industry have been ridiculously at permissioning for some time and this does not solve this. It’s all very well saying we have read only resource access, but then you connect up to JIRA and all of a sudden you’ve got a different identity system, different resource model and and more complexity than you can shake a stick at.

    Our current answer of just making the security model more and more complex isn’t working. It just means that, when things inevitably fail, we can say “well, they didn’t secure it correctly”. When even describing what is correct is hard, and setting it up is harder.

    Honestly, this looks good, but we need a root and branch rethink of security if we want something that can protect us from rogue agents.

    by moomin

Explore Birbla archives