Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What's the advantage over just using iptables?

    -A OUTPUT -m owner --uid-owner [Tor uid] -j ACCEPT
    -A OUTPUT -j DROP


So the browser itself doesn't know the IP. Then you don't have to worry about, say, a WebRTC bug leaking your IP. You also gain a considerable degree of protection from browser bugs in general.

Also, using network namespaces doesn't require root.


Using network namespaces does require root. User namespaces can give you something close enough to root to use network namespaces. But that only helps you if user namespaces are usable unprivileged, which they usually aren't, due to distro/sysadmin customization.


uid-owner hasn't worked properly for a long time. gid-owner does but oftenbreaks for apps such as KDE programs which hand-off to kioslaves for networking.

Network namespaces are much cleaner and can be created and destroyed without risk to other networking rules.


> uid-owner hasn't worked properly for a long time

Please say more. Cites would help too.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: