Re:The State of Linux Security
by pjmlp on Thursday December 22, 2016 @04:56PM
(#13240722)
And looking at embedded OSes, L4, sandboxing in Apple, Google and Microsoft OSes, the future direction is quite clear.
[ Parent
| on HN ]
Re:The State of Linux Security
by dispose13432 on Thursday December 22, 2016 @06:02PM
(#13241194)
Does Apple run on a MicroKernel? Microsoft? Google definitely doesn't (it runs on linux).
The problems they solve are orthogonal to kernel issues.
Sandboxing thwarts userspace attacks (any program I install has access to my userspace). Microkernels solve kernel side attacks.
The real irony is that Android might as well run on a microkernel, considering no OEM has any intention of ever making their firmware work on anyone else's hardware. Everyone's ROMs would be more or less just as incompatible as they are now, but at least they'd be faster and much more secure at the kernel level.
Re:The State of Linux Security
by dispose13432 on Friday December 23, 2016 @12:30AM
(#13243059)
>but at least they'd be faster
The problem with microkernal's isn't compatibility, it's speed.
QNX, Genode and L4 have solved that problem longtime ago.
The problems with microkernels are mostly urban legends.
Re:The State of Linux Security
by dispose13432 on Friday December 23, 2016 @01:22PM
(#13246326)
So why can't hurd get its act together?
Because they're still using Mach, and most capable contributors moved on to microkernel-based projects that actually aren't hopeless.
Lack of volunteers.
Lack of resources and manpower.
Google's working on Fuchsia. This might be exactly their plan.
Yes all of them do depend on some form on microkernels.
It is called L4 and is responsible for the baseband communications and secure enclave.
https://en.wikipedia.org/wiki/L4_microkernel_family#Commerci...
Apple uses XNU which is a hybrid kernel based on the Mach 3 microkernel
Re:The State of Linux Security
by tossedaway334 on Thursday December 22, 2016 @11:29PM
(#13242839)
OSX is effectively a microkernel in name only, its a microkernel with a single monolithic UNIX kernel client, and has virtually none of the advantages of a real microkernel setup with multiple clients sharing tasks.