Leah :v_trans:ChaosKitsune@woem.men
Oct 24, 2026, 9:53 AMA website asking me to disable my browser sandboxing?
No I dont think I will
Replies
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 9:54 AM
first off how does it know its sandboxed huhh? hmm
RaphaelOmegaPolice@hachyderm.ioOct 24, 2026, 12:17 PM@ChaosKitsune If the sandbox is effective, it prevents the process inside from doing a thing. So the process tries to do a thing it would be able to do without a sandbox, fails to do so, knows what's up.
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 1:10 PM
@OmegaPolice@hachyderm.io yeah so that implies it tried to do things. Exactly why I dont trust it
aaronfireborn@dragonscave.spaceOct 24, 2026, 9:55 AM@ChaosKitsune But they need it for... things. Essential functionality, I’m sure.
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 9:56 AM
@fireborn@dragonscave.space surely...
I bother to add extra over the top sandboxing or so I thought... and now a website is like pleasseee turn it off :pleading:
it shouldnt even know its in a sandbox - aaronfireborn@dragonscave.spaceOct 24, 2026, 9:58 AM
@ChaosKitsune I do wonder how it knows that. That's concerning, because they can detect that and then attempt vectors to escape it.
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 10:00 AM
@fireborn@dragonscave.space exactly. If it knows its in an extra sandbox.... does that mean its already found a way out? hmmm suspicious...
No I think the sandbox is staying even harder if they ask 
Oct 24, 2026, 10:30 AM@ChaosKitsune @fireborn careful with that, extra sandboxes tend to disable browser built-in per-origin sandboxes and you end up with less protection cause every website is in the same sandbox instead of to each their own- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 11:22 AM
@ww@xyzzy.link @fireborn@dragonscave.space nono the browser still has its own sandbox up but then I wrapped the browser in bubblewrap :3
https://naxdy.github.io/nix-bwrapper
So its an extra layer surrounding the whole browser. The websites should still be totally sandboxed themselves. - Oct 24, 2026, 11:29 AM@ChaosKitsune @fireborn have you checked? iirc the default bubblewrap config does disable it. see https://github.com/backdoorsecurity/bubblewrap_that_browser#deliberate-relaxations (couldn't find anything better rn).
- Oct 24, 2026, 11:30 AM@ChaosKitsune @fireborn also what website is it? it isn't a sandboxed iframe or something?
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 11:34 AM
@ww@xyzzy.link @fireborn@dragonscave.space yeah its an iframe, and it was some random anime watch site
- Oct 24, 2026, 5:37 PM@ChaosKitsune @fireborn i wonder if this is what it meant, not your browser sandbox
https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/sandbox
easy to detect and in some cases breaks the iframe's ability to do what it needs to - Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 6:00 PM
@ww@xyzzy.link @fireborn@dragonscave.space perhaps because I have other sandboxing settings set in the browser that both try make it less easy to track but also more secure
- Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 11:37 AM
@ww@xyzzy.link @fireborn@dragonscave.space hmm as far as I know it should be fine, unsure how to check but 1 of the examples also shows it being used on a browser.
Here is my little config for it https://git.gay/ChaoticLeah/nix-config/src/branch/master/modules/home/librewolf.nix
might need to look a bit deeper tho
To my understanding it adds similar security to what a flatpak might add - Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 11:47 AM
@fireborn@dragonscave.space @ww@xyzzy.link Seems sandboxed to the max
Will look into the 1 false more but seems fine?
- Oct 24, 2026, 5:35 PM@ChaosKitsune @fireborn yeah unprivileged userns is what bubblewrap breaks and is apparently an important part of firefox's defense-in-depth strategy for the sandbox
https://support.mozilla.org/en-US/kb/linux-security-warning
also found a heated discussion about the tradeoffs:
https://github.com/netblue30/firejail/issues/6675
i guess it still reports 6 cause they're still isolated through other means, but less securely - Leah :v_trans:ChaosKitsune@woem.menOct 24, 2026, 6:00 PM
@ww@xyzzy.link @fireborn@dragonscave.space I have not got this warning tho hmm
