Hacker News Reader

The only thing that would make me feel safer would be the sandbox.

The Windows version of Firefox is already sandboxed. (The other platforms are too, but not in release)

Mbox exists for this or FireJail, Sandboxie (Windows)or OSX sandbox-exec https://pdos.csail.mit.edu/archive/mbox/

https://wiki.mozilla.org/Security/Sandbox

Sandboxie is nonfree and after a trial period only allows sandboxing one app at once. Firejail just had a local privilege escalation exploit, but I'm still using it (although more cautiously than before). Mbox appears unmaintained, and sandbox-exec isn't even for a platform I use.

I'm quite glad that Firefox implements sandboxing of its own.

Look at the sandbox used for SubgraphOS (Debian/Jessie only) https://github.com/subgraph/oz

The goal of browser sandboxing is to protect different sites from each other. It does me no good if some malicious ad uses some plugin bug or JavaScript heap spray or something, and my sandbox successfully prevents the exploit from escaping the browser, but the same browser also has my bank open in another tab.

Given that 95% of what I do on my personal computer is in the browser, sandboxing the rest of my computer from the browser is sort of a https://xkcd.com/1200/ situation.

Reply on news.ycombinator.com