Re:Spectrum OS: a declarative, reproducible, compartmentaliz...
by fsflover on Wednesday September 15, 2021 @06:06AM
(#28537273)
> what would it actually take to get to actually secure computing assuming one was able to start with a clean slate?
> getting away from memory unsafe languages
How about secure virtualization and security through isolation instead? See Qubes OS.
Re:Spectrum OS: a declarative, reproducible, compartmentaliz...
by a-dub on Wednesday September 15, 2021 @08:53PM
(#28546530)
> How about secure virtualization and security through isolation instead? See Qubes OS.
yeah, that's kinda what i meant by "something like this that builds on existing primitives to get there may be the only real, feasible thing".
it looks like qubes uses vms as an existing (heavyweight) primitive to limit blast radii for existing software and systems. i wonder if you can do better if you start from scratch.
Re:Spectrum OS: a declarative, reproducible, compartmentaliz...
by fsflover on Thursday September 16, 2021 @06:58AM
(#28550184)
> existing (heavyweight)
It's not exactly heavyweight, because Xen hardware virtualization eats up only additional 10% of CPU. However, GPU acceleration is switched off for security reasons.
in reality, maybe something like this that builds on existing primitives to get there may be the only real, feasible thing... but assuming you could start from scratch, what would it look like?