I mean, of course? Especially, why would I put ssh keys and similar in the container?
This still doesn't mean that one can install just any package, but it does make it much more difficult for it to do much harm. Breaking out of a container is not as trivial as it once was. That said, it is not a perfect solution, so I'd be happy to hear of better ones. Any suggestions?
Given what a dumpster fire npm ecosystem is security wise, it's best to run the whole build chain in a container anyway, at least for frontend apps. This way you also don't care about the chosen package manager or node.js version - you can just set it as you wish in the Dockerfile. It does take more disk space though, but to me it's a nice compromise.
Me too. Had to go back to Windows at $JOB recently and find the experience... unpleasant, to put it mildly. I guess once you get used to a certain way it's difficult to change it. Hoping to get rid of Windows again soon. Can't imagine using W11, from what I've seen.
I am still hoping someone picks up development of uMatrix. NoScript is great, but just too tiresome to use on the modern web, while uMatrix has this genius UI where you can pick the allowed parts of the page easily and save the rules for later if needed. Highly recommend it, though it is sadly no longer supported. For now it works. :-/
> The number of new meltdowns per decade rounds to zero, to five significant figures.
That's a weird metric (one meltdown is quite a catastrophe) and the calculation seems suspicious too. Between Chernobile and Fukushima I don't see how this could be correct.
I do find your other points more convincing, though with some "citation needed" wrt. coal.
This still doesn't mean that one can install just any package, but it does make it much more difficult for it to do much harm. Breaking out of a container is not as trivial as it once was. That said, it is not a perfect solution, so I'd be happy to hear of better ones. Any suggestions?