For example, you may isolate a specific customer to bare metal so an escape doesn't compromise other customers. But within that bare metal, you may run containers because they make it easier to work with a read only root filesystem that's also trivial to upgrade. You can also add on user namespaces and seccomp in the container to minimize the risk of a container escape. And then the application may have its own sandbox that limits individual capabilities and which API calls it can run.
Every use case is different, and some layers may not be available depending on that use case. But rather than picking one point on the spectrum, one should pick a list of technologies that best solve each use case.
The analogy is that each layer is a slice of Emmental cheese. You end up with a bad event, only if all the holes in the slices align.
My uBlock origin shows that googlefonts.com and fonts.googleapis.com are being blocked.
It irks me a bit that your message explicitly mentions two trackers but it fails to mention the Google tracking. Google is also not mentioned in your privacy policy. Is there a reason for this?
https://developers.google.com/fonts/faq/privacy
> For clarity, Google does not use any information collected by Google Fonts to create profiles of end users or for targeted advertising.
IP, user agent, language headers and network timings are enough to fingerprint and associate you with any other accounts at US tech companies. The visited website is linked via Referer / Origin headers to your browsing history.
All of this tracking is passive and there is no way to check for an independent observer.
Yet here you are defending the most privacy invasive company on the planet.
It's passive tracking, but it's tracking.
I also think the article shouldn't mention chroot. From the man page:
> In particular, it is not intended to be used for any kind of security purpose,
I guess it could be part of a sandbox, but there are better tools for that purpose.
(I'm not sure what point there is in giving feedback on an article that's almost entirely LLM-generated, though.)
The article maps out the differences between common execution environments—from physical bare metal and VMs to containers, process sandboxes, and virtual environments—to create a mental model of where the "isolation boundary" actually sits for each tool.
Nobody should ever forget this.
But I would say this next part is about the opposite for bare metal though:
>Use Case: High-performance computing (HPC), large databases, or legacy systems that require direct hardware access.
To get the utmost reliability out of adequate hardware then bare metal is more suitable for almost everything except for special situations.
Unless something is really wrong with the software or the overall hardware/software approach.
That's not completely true. With dynamic linking (now supported in WASIX), you can generate and link Wasm modules at runtime easily.
1. to create web versions of applications that are traditionally desktop only to render things like Parquet, PSD, TIFF, SQLite, EPS, ZIP, TGZ, and many more, where C libraries are often the reference implementations. There are almost a hundred supported file formats, most of which are supported through WASM
2. to create plugins that extend the backend and add your own endpoint or middleware as a way to enforce the code run in a constrained environment without the ability to send people's file out
3. in the workflow engine to enable people to run their own sandboxed scripts without giving those a blank check to go crazy
But also - it's lacking things like a unified positioning + required knowledge to understand it is quite large compared to average dev + most people have no real use for it. It's mostly too "abstract high level" and "low level" for most devs.
