On: Twenty One Zero-Days in FFmpeg

[fpoling]

Browsers run it in a sandbox process together with allocator hardening. Most of the bugs then are just crashed of the sandbox

Another option is WASM or WASM-style sandboxes if using another process is undesirable.

[johnnythunder → fpoling]

One chained sandbox escape away from compromise.

[ttoinou → johnnythunder]

Ahah

But are the compiler+OS that runs the ffmpeg executable really a sandbox ?

[fpoling → ttoinou]

For executables on Linux there are things like bubblewrap or firejail. One can also use a restrictive container. But those are strictly weaker than browser sandboxes.

The most secure way presently is to use qubes-os that allows to use a very hardened VM to run individual applications.

[loeg → johnnythunder]

Which is of course better than zero sandbox escapes.