News for hackers. Stuff that matters.

A comment on Cloud companies consider Intel rivals after security flaws found. Parent comment

Re:Cloud companies consider Intel rivals after security flaw... by jordanthoms on Saturday January 13, 2018 @01:08AM (#16138478)
It's more than that even - given that a high portion of the code being run now is using virtual machines, a lot of that protection is redundant. If all code is run inside VMs and zero 'native' code is allowed, then you could run without needing protection rings, system call overhead, memory mapping, etc - which in theory could more than make up for the virtual machine overhead.

This was being explored with Microsoft's Singularity and Midori projects but seems to be a dormant idea.

A fun talk on this idea with JavaScript: https://www.destroyallsoftware.com/talks/the-birth-and-death...

[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by bestham on Saturday January 13, 2018 @03:30AM (#16138752)
I don’t think it works like that. You still need protection between the rings inside the VM and the CPU is providing that protection. The VM is not only a user process for the host, it is executing its kernel code in the virtualized ring 0 on the CPU (where its still the CPU that provides protection).
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by jordanthoms on Sunday January 14, 2018 @08:35PM (#16147797)
As i understand it, with this approach you wouldn't have a separation between kernel code and the virtual machine - everything runs in a single address space and you rely on the virtual machine verifying the code as it JITs it.
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by tedunangst on Saturday January 13, 2018 @03:43AM (#16138777)
And that, of course, is how you get Spectre.
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by jordanthoms on Saturday January 13, 2018 @04:26AM (#16138898)
It should be possible to apply retpoline in the JIT to mitigate that.
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by contrarian_ on Saturday January 13, 2018 @06:23AM (#16139154)
Emphasis on "mitigate".
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by yjftsjthsd-h on Saturday January 13, 2018 @02:39AM (#16138658)
Isn't that a unikernel?
[ Parent | on HN ]
Re:Cloud companies consider Intel rivals after security flaw... by SolarNet on Saturday January 13, 2018 @03:16AM (#16138723)
No. Each copy of the VM is still it's own process. The kernel just trusts the VM to be safe.
[ Parent | on HN ]