https://grapheneos.social/@GrapheneOS/116200213555848065
Graphene has bad things to say about its competitors. What is the Truth?
@postmarketOS
@WeAreFairphone
@linmob

Does GOS' comment have in mind Volla #SailfishOS or UbuntuTouch? I am not a fan of Ubuntu much but love Debian. Volla, however is just way over-priced for most people outside the EU who can not order it anyway. Maybe GOS rates UbuntuTouch as a low grade product.
But Sailfish makes use of #firejail, which is very comprehensive on the command line level. If an app on GOS is not using
Compatibilty Mode, then it might be better off than with firejail or at least on par in terms of sandboxing. There are of course other factors.

Mainly, just wanted to make the point of distinguishing hardware projects from software projects here.

How would you rate Postmarket OS' security strategy (on Fairphone, for example)?

Have you ever been locked-out of your own account "for your protection"? 🤦

🔗 https://tech.michaelaltfield.net/2026/02/03/single-site-browser-firejail-proxychains/

This guide 👆 shows how to setup a Persistent, Sandboxed, Single-Site-Browser using #firejail and #proxychains to minimize the risk of Evil-Corp effectively issuing a #DOS attack against you (due to false positives)

#ai #aislop #opsec #infosec #security #privacy

Hardening with Firejail, Landlock, and bubblewrap

Recently I've been looking into securing my laptop a bit. By default, every single program has access to everything: filesystem, network, other programs.

First, I started looking into Firejail. It allows specifying paths the program can access, as well as the network and other special things. It's not bad and I used it for a while.

What I don't like about Firejail is that it's setuid: it runs as root, sets up the sandbox, then starts the program that is passed as an argument. If there is a problem in Firejail then it can even extend the blast radius.

Then I learned about Landlock. It is unprivileged and also allows restricting the network. At some point I found a [CLI](https://github.com/Zouuup/landrun) that makes it easy to run. Landlock solves the privilege problem: it restricts the process without having more permissions to do so.

The problem with Landlock is its fs restrictions are a bit too coarse: if a directory is allowed then everything below it is also allowed. For example, giving read access to $HOME also gives read access to the chromium profile.

Now I'm looking into bubblewrap. It promises to combine Firejail and Landlock in the best way: unprivileged and also allows layering filesystem access.

I'm still working on moving my dotfiles to bubblewrap and it takes some mental energy to do that. But is seems like it's going to be a good next step.

#security #linux #bwrap #landlock #firejail

Originally published [on my blog](https://advancedweb.hu/shorts/hardening-with-firejail-landlock-and-bubblewrap/)

I switched from #AppArmor to #Firejail on my desktop. For me Firejail's configuration is much less cryptic than AppArmor's :) But I noticed there was no syntax highlighting for Firejail config files in #Emacs, so I created a simple mode using SMIE:

https://github.com/grafov/firejail-mode

Because GNU/Emacs should have a mode for any task, you know! #butterfly

Well... bzflag is a trap, in case anyone is tempted by that honey pot. #bzflag

Got hacked and uncertain of the scope, gonna be a week of fixing things.

I really don't have the energy for this, but whatever, here we go... I was just saying how I enjoyed looking into intrusions...

Feel so foolish. Wasn't even running it in #firejail.

Not sure if they gained persistence, but pretty sure they could have. Paranoia makes me assume it was worse than it was.