By: anon2 (anon.delete@this.anon.com),
Room: Moderated Discussions
Gabriele Svelto (gabriele.svelto.delete@this.gmail.com) on March 16, 2021 7:23 am wrote:
> anon2 (anon.delete@this.anon.com) on March 15, 2021 8:00 pm wrote:
> > Yes, some do that indeed. And your most common sandboxed application around when its running on the most
> > common platform around (i.e., Linux/Android) uses a very different architecture that does not farm out
> > all requests via IPC to a broker service, but instead does the majority of the filtering inline via kernel
> > facilities (namespaces, eBPF). I'll give you three guesses as to which model has better performance.
>
> How is that relevant to the point? You claimed there wasn't software that proxy'd
> function calls via IPC,
No I didn't.
> I've shown you there is and it's very common. Use cases are
> different, platforms are different, there are no one-size-fits-all solutions.
> anon2 (anon.delete@this.anon.com) on March 15, 2021 8:00 pm wrote:
> > Yes, some do that indeed. And your most common sandboxed application around when its running on the most
> > common platform around (i.e., Linux/Android) uses a very different architecture that does not farm out
> > all requests via IPC to a broker service, but instead does the majority of the filtering inline via kernel
> > facilities (namespaces, eBPF). I'll give you three guesses as to which model has better performance.
>
> How is that relevant to the point? You claimed there wasn't software that proxy'd
> function calls via IPC,
No I didn't.
> I've shown you there is and it's very common. Use cases are
> different, platforms are different, there are no one-size-fits-all solutions.
