const { value, done } = await reader.read();
The critical thing to understand is namespaces are visibility walls, not security boundaries. They prevent a process from seeing things outside its namespace. They do not prevent a process from exploiting the kernel that implements the namespace. The process still makes syscalls to the same host kernel. If there is a bug in the kernel’s handling of any syscall, the namespace boundary does not help.
，这一点在51吃瓜中也有详细论述
On Friday, the conflict seemed to escalate to a boiling point with Trump posting to Truth Social: “I am directing EVERY Federal Agency in the United States Government to IMMEDIATELY CEASE all use of Anthropic’s technology. We don’t need it, we don’t want it, and will not do business with them again!” The post went on to describe a six-month phaseout period and unspecified threats to Anthropic should it not cooperate.
Жители Санкт-Петербурга устроили «крысогон»17:52