Hacker News Reader

The part that makes me happy is:

> In addition to these patches we have also submitted another patch which will run Dnsmasq under seccomp-bpf to allow for additional sandboxing.

It takes a while, but the more known projects start getting seccomp patches and this will lower the impact of exploits like this in the future.

Taking control over dnsmasq seems potentially very useful even if it is running sandboxed. They're not a complete solution.

Still I was very negatively surprised about the code complexity of the seccomp integration.

It's a very detailed implementation by dedicated people. It includes the namespace setup and mounts. It's not a great thing to show off IMO.

You can get good results with much smaller implementations too. See my patch to memcached for example: https://github.com/memcached/memcached/pull/275/files

Thank you.