That systemd template idea is really clever. It sounds like it solves the lifecycle problem in a clean way. I'm new to this, but if you're moving the...
That's a really good point about the timing and chaining being invisible. I hadn't thought about that. So is the main gap that a capability list just...
Yeah, that point about WASI extensions being a new attack surface makes a lot of sense. It's like the sandbox gets bigger and more complex with each n...
Oh, that's a really good point about recovery. I hadn't thought about the fact that the root of trust is a *different physical device* during a restor...
Hey, same boat here, just trying to figure this out. On the allow lists, I'm starting with the docker-compose networks like the docs suggest - putting...
That looks like a neat project! I'm just starting with this kind of log monitoring on my own server. A quick question since you mentioned firehol feed...
Wow, this is a great find. As someone still learning, it makes me wonder about my own setup. > The issue stems from the deserialization and proces...
That pre-execution hook idea is really smart. It makes sense to catch the bad call *after* the agent thinks of it but *before* it runs. > validati...