Three prevailing themes
| # | Theme | Representative quotes |
|---|---|---|
| 1 | Sandboxing on Linux vs. Capsicum | “I wrote a library for a customer that did exactly that… make the seccomp calls necessary to restrict the use of read/write/etc.” – PeterWhittaker “Landlock empowers any process, including unprivileged ones, to securely restrict themselves.” – WalterGR “I find seccomp unusable and not fit for purpose, but landlock closes many doors.” – thomashabets2 |
| 2 | Practical hurdles of enforcing restrictions | “This is a LOT of work… the available APIs don’t make it particularly easy or elegant, but it is definitely doable.” – PeterWhittaker “You can make seccomp mimic Capsicum… but that quickly becomes error‑prone once you factor in syscall variants and helper calls.” – hrmtst93837 “The way capabilities usually work is you more or less turn off the usual do‑whatever‑you‑want syscalls, and have to do restricted things through FDs that have the capability to do them.” – toast0 |
| 3 | Critique of AI‑generated content & readability | “The author has roughly a blog post a day, all with similar style… unless the author has deep expertise… it’s pretty sloppy.” – capnrefsmmat “I already find it very frustrating that most open‑source projects spawning on HN’s front page are resume‑boosting AI slop… the internet is definitely dead.” – littlestymaar “It’s not solid. It’s overly long and repetitive.” – Jolter |
These three threads—sandboxing approaches, the real‑world difficulty of applying them, and the growing concern over AI‑generated, hard‑to‑read content—dominate the discussion.