this post was submitted on 19 Nov 2023
-1 points (0.0% liked)
Games
16785 readers
850 users here now
Video game news oriented community. No NanoUFO is not a bot :)
Posts.
- News oriented content (general reviews, previews or retrospectives allowed).
- Broad discussion posts (preferably not only about a specific game).
- No humor/memes etc..
- No affiliate links
- No advertising.
- No clickbait, editorialized, sensational titles. State the game in question in the title. No all caps.
- No self promotion.
- No duplicate posts, newer post will be deleted unless there is more discussion in one of the posts.
- No politics.
Comments.
- No personal attacks.
- Obey instance rules.
- No low effort comments(one or two words, emoji etc..)
- Please use spoiler tags for spoilers.
My goal is just to have a community where people can go and see what new game news is out for the day and comment on it.
Other communities:
Beehaw.org gaming
Lemmy.ml gaming
lemmy.ca pcgaming
founded 1 year ago
MODERATORS
Yet, it is a very not-really-good idea to run stuff on a web browser. Web browsers are a notoriously insecure, slow platform with controls ("Back", "Reload", ...) which are not optimized to run applications.
edit: I did not expect that the "modern web" crowd would now come here to berate (and downvote) me for the sacrilege of not unconditionally considering web browsers to be the very best piece of software for every purpose. My fault, sorry. I'm out of here, this is pointless.
Let me get this straight, you think running something in a browser with its sandboxed design, is somehow less secure than downloading executables off of GitHub?
Yes, because browser sandboxes will NEVER be as secure as kernel sandboxes.
(Run the browser in the kernel sandbox)
Compared to what?
Compared to native platforms.
Okay, I have to admit that that's leaving me a bit nonplussed. Assume for a moment that I am concerned about the security implications of running an open-source Tomb Raider engine implementation. How exactly are you proposing running this in a more-secure fashion?
If I run an executable on my platform -- say, an ELF binary on Linux -- then normally that binary is going to have access to do whatever I can do. That's a superset of what code running inside a Web browser that I'm running can do.
Are you advocating for some form of isolation? If so, what?
EDIT: And I've got another question for you. Let's say that you're worried about security of browser APIs. How do you avoid this? Because if your browser is vulnerable to some exploit in its WebGL implementation, not clicking on a link explicitly labeled as going to a website that uses 3D -- which is what you appear to be urging people to do -- isn't going to avoid it. Any site you browse to -- including those not labeled as such -- could well expose you to that vulnerability.
EDIT2: In another comment, you say that you want to trust the "kernel" instead of the browser. Okay, fine. There are a whole class of isolation mechanisms there. What mechanism are you proposing using? Remember that you are needing to give access to your 3d hardware to whatever software package is involved here, and the Linux kernel, at least, doesn't have a mechanism for creating virtual, restricted "child" graphics devices. The closest I can think of on Linux you can get at a kernel level there would be pass-through from a VM to a dedicated graphics adapter, which probably isn't going to be an option for most people and I have doubts about being a carefully-hardened pathway compared to browser APIs.
Kernel sandboxing. I mean, breaking out of browser "sandboxes" is a game these days.
Which is why using the web without JavaScript is a security measurement which I strongly recommend to enable. Sure, many sites will be "less interactive" then, but I'm afraid that it is the only solution. For the usually: rather small number of websites which you absolutely need to use with JavaScript enabled (do you, really?), a separate browser inside a container (or VM) would be a good option. I admit that this is not the most comfortable setup, but I really prefer to be safe than sorry. YMMV, but you asked.
That's a class of different mechanisms. I updated my comment above. I'll repeat the text there:
Virtually every website out there today uses Javascript. Lemmy uses Javascript. What makes this particular website a risk?
Yeah, I do. Fifteen years ago, I used NoScript, and some things broke, but it was usable; there were enough people running non-JS-capable browsers that websites had a reasonable chance of functioning. The Web generally does not function without Javascript today.
Most of those work without it.
Lemmy is one of several ActivityPub-capable applications. You do not need to use Lemmy inside a web browser in order to participate here. In fact, you don't even need to use a web browser.
I disagree. Some websites (with lazy developers) work less well without JavaScript. You'll gain less annoyances (no JS = no pop-ups and no sophisticated anti-adblock techniques), more speed, less energy consumption, less potential security risks. You'll lose... not really much. "Web applications" (usually worse, slower and less reliable than installed software), a couple of websites which are very focused on providing effects over contents - sounds like a fair deal to me, but again, YMMV.
Yes, there will never be absolute security. If it runs on a computer, it most likely has security flaws.