Hacker News Reader

An easier and more immediately obvious approach would be to sandbox the codecs, so that they cannot do anything other than what they need to do.

Well-engineered systems like Genode focus on this approach, leveraging capabilities.

This is already done in most places, like browsers. But they want to remove the sandbox for performance reasons.

This is nonsense. The IPC in and out of the codec process cost is invisible, relative to the cost of encoding/decoding video.