Clarify that Toolbx isn't a security mechanism #29
Conversation
Mention that Toolbx is meant for system administrators to troubleshoot the host operating system. The word 'debugging' is often used in the context of software development, and hence most readers might not interpret it as 'troubleshooting'.
Using the word 'containerized' gives the false impression of heightened security. As if it's a mechanism to run untrusted software in a sandboxed environment without access to the user's private data (such as $HOME), hardware peripherals (such as cameras and microphones), etc.. That's not what Toolbx is for. Toolbx aims to offer an interactive command line environment for development and troubleshooting the host operating system, without having to install software on the host. That's all. It makes no promise about security beyond what's already available in the usual command line environment on the host that everybody is familiar with. containers/toolbox#1020
|
So what are alternatives to |
|
The change is very much needed. The GitHub project also needs a direct link to https://containertoolbx.org/ and the security note could be much more prominent. EDIT: Sent PR #30 to get security note its own header. |
Override |
|
@debarshiray thanks. #183 is 26 pages long thread. The short notice in README/website would be sufficient. |
It already does. Twice - once at the top of the |
I mush be blind. Where?
|
Oh, sorry. I thought you meant containers/toolbox by the GitHub project. I have now added a link to the website to containers/containertoolbx.org. |
Using the word containerized gives the false impression of heightened security. As if it's a mechanism to run untrusted software in a sandboxed environment without access to the user's private data (such as
$HOME), hardware peripherals (such as cameras and microphones), etc.. That's not what Toolbx is for.Toolbx aims to offer an interactive command line environment for development and troubleshooting the host operating system, without having to install software on the host. That's all. It makes no promise about security beyond what's already available on the usual command line environment on the host that everybody is familiar with.
containers/toolbox#1020