Hacker News new | ask | show | jobs
by jbk 2817 days ago
> VLC [...] filesystem=host

See my comment on why it's not easy to fully sandbox software like VLC: https://news.ycombinator.com/item?id=14409234

The author is correct, in the fact that flatpak-vlc is not a secure sandbox.

1 comments

Thanks for sharing the info. I'm just curious - how would splitting VLC into multi processes solve the permission issue, since the sub-processes will still need access anyway?
Each subprocess would only get one permission, the one that it actually need. The critical parts (audio decoders, video decoders, parsers) would not get access to $HOME or network, for example.
Thanks, that makes sense.