3 ms·
It wouldn't be 100 implementations of /dev/random, but one implementation per language. Security with a C / C++ based system that has to be everything to every
by mahyarm 11y ago
It wouldn't be 100 implementations of /dev/random, but one implementation per language.
Security with a C / C++ based system that has to be everything to everyone is pretty much intractable. If you have a java unikernel server for example, you only have one programming language which you can understand from top to bottom with a lot of well written open source libraries.
Then you have a hypervisor, from what I understand can be far simpler than the linux kernel, POSIX and everything else. You only have two smaller layers to understand, versus the huge unix ecosystem stack to understand.
Also changing something inside your unikernel stack would be a git commit & deploy away. Patching a kernel vulnerability which you probably don't understand is a significantly longer undertaking.
- nickpsecurity 11y ago"Then you have a hypervisor, from what I understand can be far simpler than the linux kernel, POSIX and everything else. You only have two smaller layers to understand, versus the huge unix ecosystem stack to understand." That's exactly it. It's how it was done in old days for highly assured systems and it still applies. Side advantage is that anything you create that you control you can apply the best software and security engineering methods possible. So, the big messy OS might be hard to hit with static or covert channel analysis but your microkernel/hypervisor/VMM might do fine.