The Browser Is the Worst Sandbox Ever Designed
If we can get the defect rate down to zero, then the product of that and the attack surface will still be zero.<p>If we can&#x27;t do that, how much will sandboxing help? Sure, we can make a much smaller surface that we expose - let&#x27;s say 1% of the size of what the browser currently exposes. Will that be good enough though? Xen&#x27;s surface is about as small as you can get for a reasonable general-purpose sandbox, and, per the article, Xen has a lot of vulnerabilities too.<p>I think the only option is to push the defect rate down to zero. (This may be impossible; if so, we&#x27;re all going to die. Computing power will inevitably advance to the point where any vulnerable system can be cracked by a lone terrorist, and economics and our inability to coordinate ensure that power plants, water treatment facilities, automated bioengineering facilities etc. are going to be computerized.)<p>Rust is, I think, worthwhile as a step on the road towards provably correct programs - memory management isn&#x27;t everything, but it&#x27;s something. Sandboxing OTOH feels like a dead end, because it&#x27;s inherently ad-hoc and unprincipled.