Efficiently sandboxing Firefox by compiling potentially vulnerable libraries to wasm, and then compiling wasm to C!
miniblog.
Related Posts
Blogged: Devlog 2: The Importance of Sandboxing
Exploring PL opportunities when you have a first-class sandbox.
I find it odd that people recommend Docker for sandboxing agentic coding tools. Isn't it easier to just create a separate user account on the machine?
It's an established security boundary, and viewing output is easy (just make the user's home directory world readable).
Contrasting exploit mitigations and sandboxing techniques in Firefox and Chromium: