miniblog.

I find it odd that people recommend Docker for sandboxing agentic coding tools. Isn't it easier to just create a separate user account on the machine? It's an established security boundary, and viewing output is easy (just make the user's home directory world readable).

Efficiently sandboxing Firefox by compiling potentially vulnerable libraries to wasm, and then compiling wasm to C!

Contrasting exploit mitigations and sandboxing techniques in Firefox and Chromium: