9 ms·

I never said anything of Linux (I am critical of it), and I don't know how you came up with this odd Linux/Solaris dichotomy.

cthalupa 11y ago
What are the alternatives, in the *nix world? The BSDs are in much the same place as Linux on most of those specifics, or further behind, or heavily using the tech from the Solaris side. HP-UX? AIX? What do you think is doing better than Solaris or Illumos on those things?
- nickpsecurity 11y ago
  You don't do it in UNIX because UNIX is fundamentally broken. That's the point. You do it through specialist software that works around the various problems. A common approach (i.e. compromise) in high-assurance security was to split systems between an untrusted, UNIX VM and critical components running directly on a microkernel/hypervisor. The kernels themselves were built as robust as possible sometimes with every potential, control or error state known. The apps outside VM's often used Ada or Java runtimes whose assurance and features were customized for apps needs. Robust middleware handled mediation and sometimes recovery. Many systems like this survived strong pentesting and worked without reported failures the field (or only failed-safe). Then, there's the shit most people are doing and that Bryan advocates with UNIX. I also called him out on it listing numerous counters... with references backing them... to his comment at vezzy-fnord above. https://news.ycombinator.com/item?id=10325607 https://news.ycombinator.com/item?id=10325607 Secure UNIX had already been tried by geniuses for a decade or two with always same results: architecture, language, and TCB were inherently so complex and insecure that even smallest versions had many 0-days and dozens of covert channels. He didn't respond, likely since he uses assertions instead of evidence. And all published evidence that I've ever seen contradicts his view of UNIX model superiority in robustness of any kind, sometimes performance. Now, he's making all kinds of assertions about unikernels, deliberately avoiding evidence on some (eg performance), praising UNIX model/tech, and ignoring faults in his own approach. Should we take his word this time given prior result? Definitely not.
  - chris_wot 11y ago
    I've seen this comment about Unix being fundamentally broken a few times... could you point to a source that explains this in more detail? (This question is not meant to be disagreeable, I'm genuinely interested in finding out what the issues are).
    - nickpsecurity 11y ago
      Not organized to be able to just throw out a reference and many disappeared over time as old web faded. It's more something you see relative to other OS's than an absolute. I really need to try to integrate all the examples sometime. Here's a few, esp from past, that give you an idea. Historical look at quite a few http://brinch-hansen.net/papers/2001b.pdf http://brinch-hansen.net/papers/2001b.pdf Note: A number were concurrency safe, had a nucleus that preserved consistency, or were organized in layers that could be tested independently. UNIX's was actually a watered down MULTIC's & he's harsh on it there. I suggest you google it too. Burrough's B5000 Architecture (1961-) http://www.smecc.org/The%20Architecture%20%20of%20the%20Burroughs%20B-5000.htm http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr... Note: Written in ALGOL variant, protected stack, bounds checks, type-checked procedure calls dynamically, isolation of processes, froze rogue ones w/ restart allowed if feasible, and sharing components. Forward thinking. IBM System/38 (became AS/400) https://homes.cs.washington.edu/~levy/capabook/Chapter8.pdf https://homes.cs.washington.edu/~levy/capabook/Chapter8.pdf Note: Capability architecture at HW level. Used intermediate code for future-proofing. OS mostly in high-level language. Integrated database functionality for OS & apps. Many companies I worked for had them and nobody can remember them getting repaired. :) Oberon System http://www.projectoberon.com/ http://www.projectoberon.com/ http://www.cfbsoftware.com/modula2/Lilith.pdf http://www.cfbsoftware.com/modula2/Lilith.pdf Note: Brilliance started in Lilith where two people in two years built HW, OS, and tooling with performance, safety, and consistency. Designed ideal assembly, safe system language (Modula-2), compiler, OS, and tied it all together. Kept it up as it evolved into Oberon, Active Oberon, etc. Now have a RISC processor ideal for it. Hansen did similar on very PDP-11 UNIX was invented on with Edison system, which had safety & Wirth-like simplicity. OpenVMS https://en.wikipedia.org/wiki/OpenVMS https://en.wikipedia.org/wiki/OpenVMS Note: Individual systems with good security architecture & reliability. Clustering released in 80's with up to 90 nodes at hundreds of miles w/ uptime up to 17 years. Rolling upgrades, fault-tolerance, versioned filesystem using "records," integrated DB, clear commands, consistent design, and great cross-language support since all had to support calling convention and stuff. Used in mainframe-style apps, UNIX-style, real-time, and so on. Declined, pulled off market, and recently re-released. Genera LISP environment http://www.symbolics-dks.com/Genera-why-1.htm http://www.symbolics-dks.com/Genera-why-1.htm Note: LISP was easy to parse, had REPL, supported all paradigms, macro's let you customize it, memory-safe, incremental compilation of functions, and even update apps while running. Genera was a machine/OS written in LISP specifically for hackers with lots of advanced functionality. Today's systems still can't replicate the flow and holistic experience of that. Wish they could, with or without LISP itself. BeOS Multimedia Desktop http://birdhouse.org/beos/byte/29-10000ft/ http://birdhouse.org/beos/byte/29-10000ft/ https://www.youtube.com/watch?v=BsVydyC8ZGQ https://www.youtube.com/watch?v=BsVydyC8ZGQ Note: Article lists plenty of benefits that I didn't have with alternatives for long time and still barely do. Mainly due to great concurrency model and primitives (eg "benaphors"). Skip ahead to 16:10 to be amazed at what load it handled on older hardware. Haiku is an OSS project to try to re-create it. EROS http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf Note: Capability-secure OS that redid things like networking stacks and GUI for more trustworthyness. It was fast. Also had persistence where a failure could only loose so much of your running state. MINIX 3 and Genode-OS continue the microkernel tradition in a state where you can actually use them today. MINIX 3 has self-healing capabilities. QNX was first to pull it off with POSIX/UNIX compatibility, hard real-time, and great performance. INTEGRITY RTOS bulletproofs the architecture further with good design. SPIN OS http://www-spin.cs.washington.edu/ http://www-spin.cs.washington.edu/ Note: Coded OS in safe Modula-3 language with additions for better concurrency and type-safe linking. Could isolate apps in user-mode then link performance-critical stuff directly into the kernel with language & type system adding safety. Like Wirth & Hansen, eliminates all the abstraction gaps & inconsistency in various layers on top of that. JX OS http://www4.cs.fau.de/Projects/JX/publications/jx-sec.pdf http://www4.cs.fau.de/Projects/JX/publications/jx-sec.pdf Note: Builds on language-oriented approach. Puts drivers and trusted components in Java VM for safety. Microkernel outside it. Internal architecture builds security kernel/model on top of integrity model. Already doing well in tests. Open-source. High tech answer is probably Duffy's articles on Microsoft Midori. So, there's a summary of OS architectures that did vastly better than UNIX in all kinds of ways. They range from 1961 mainframes to 1970-80's minicomputers to 1990's-2000's desktops. In many cases, aspects of their design could've been ported with effort but just weren't. UNIX retained unsafe language, root, setuid, discretionary controls, heavyweight components (apps + pipes), no robustness throughout, GUI issues and so on. Endless problems many others lacked by design. Hope the list gives you stuff to think about or contribute to. :)
- AnimalMuppet 11y ago
  I believe that vezzy-fnord was saying that the unix world was not the ultimate in OS design. Therefore asking where in the unix world is better is missing the point. Off topic: How do you get an asterisk in your comment without HN flipping it into italics?
  - nickpsecurity 11y ago
    Just found a brief formatting guide that say you put exactly one space after the first asterisk. asterisk space stuff in between asterisk. Let's try it: * no italics* EDIT: Ok, space is visible after first and second one disappears. Now I want to know what the commenter is doing too lol. EDIT 2: The closing asterisk reappeared after I added text after it. Stranger.
    - cthalupa 11y ago
      It's working for me because I'm only using one asterisk, but not using any special formatting. As long as I only say *Nix once, no italics...
      - nickpsecurity 11y ago
        Ohhh. Yeah, you only used it once. So using it twice is still open to experimentation. Hackers, have at it!
        AnimalMuppet 11y ago
        Test: I want to say * nix, and then to *italicize * nix*. Result: I want to say * nix, and then to italicize nix. That also left things in italics, which I'll close now. Test 2: I want to say * nix, and then to *italicize *nix*. Result 2: I want to say * nix, and then to italicize nix. Again, this left italics on. So there doesn't seem to be a way to do what I was trying to do. This is why I said "unix" rather than, you know...
        11y ago

cthalupa 11y ago

What are the alternatives, in the *nix world? The BSDs are in much the same place as Linux on most of those specifics, or further behind, or heavily using the tech from the Solaris side. HP-UX? AIX? What do you think is doing better than Solaris or Illumos on those things?

nickpsecurity 11y ago
You don't do it in UNIX because UNIX is fundamentally broken. That's the point. You do it through specialist software that works around the various problems. A common approach (i.e. compromise) in high-assurance security was to split systems between an untrusted, UNIX VM and critical components running directly on a microkernel/hypervisor. The kernels themselves were built as robust as possible sometimes with every potential, control or error state known. The apps outside VM's often used Ada or Java runtimes whose assurance and features were customized for apps needs. Robust middleware handled mediation and sometimes recovery. Many systems like this survived strong pentesting and worked without reported failures the field (or only failed-safe). Then, there's the shit most people are doing and that Bryan advocates with UNIX. I also called him out on it listing numerous counters... with references backing them... to his comment at vezzy-fnord above. https://news.ycombinator.com/item?id=10325607 https://news.ycombinator.com/item?id=10325607 Secure UNIX had already been tried by geniuses for a decade or two with always same results: architecture, language, and TCB were inherently so complex and insecure that even smallest versions had many 0-days and dozens of covert channels. He didn't respond, likely since he uses assertions instead of evidence. And all published evidence that I've ever seen contradicts his view of UNIX model superiority in robustness of any kind, sometimes performance. Now, he's making all kinds of assertions about unikernels, deliberately avoiding evidence on some (eg performance), praising UNIX model/tech, and ignoring faults in his own approach. Should we take his word this time given prior result? Definitely not.
- chris_wot 11y ago
  I've seen this comment about Unix being fundamentally broken a few times... could you point to a source that explains this in more detail? (This question is not meant to be disagreeable, I'm genuinely interested in finding out what the issues are).
  - nickpsecurity 11y ago
    Not organized to be able to just throw out a reference and many disappeared over time as old web faded. It's more something you see relative to other OS's than an absolute. I really need to try to integrate all the examples sometime. Here's a few, esp from past, that give you an idea. Historical look at quite a few http://brinch-hansen.net/papers/2001b.pdf http://brinch-hansen.net/papers/2001b.pdf Note: A number were concurrency safe, had a nucleus that preserved consistency, or were organized in layers that could be tested independently. UNIX's was actually a watered down MULTIC's & he's harsh on it there. I suggest you google it too. Burrough's B5000 Architecture (1961-) http://www.smecc.org/The%20Architecture%20%20of%20the%20Burroughs%20B-5000.htm http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr... Note: Written in ALGOL variant, protected stack, bounds checks, type-checked procedure calls dynamically, isolation of processes, froze rogue ones w/ restart allowed if feasible, and sharing components. Forward thinking. IBM System/38 (became AS/400) https://homes.cs.washington.edu/~levy/capabook/Chapter8.pdf https://homes.cs.washington.edu/~levy/capabook/Chapter8.pdf Note: Capability architecture at HW level. Used intermediate code for future-proofing. OS mostly in high-level language. Integrated database functionality for OS & apps. Many companies I worked for had them and nobody can remember them getting repaired. :) Oberon System http://www.projectoberon.com/ http://www.projectoberon.com/ http://www.cfbsoftware.com/modula2/Lilith.pdf http://www.cfbsoftware.com/modula2/Lilith.pdf Note: Brilliance started in Lilith where two people in two years built HW, OS, and tooling with performance, safety, and consistency. Designed ideal assembly, safe system language (Modula-2), compiler, OS, and tied it all together. Kept it up as it evolved into Oberon, Active Oberon, etc. Now have a RISC processor ideal for it. Hansen did similar on very PDP-11 UNIX was invented on with Edison system, which had safety & Wirth-like simplicity. OpenVMS https://en.wikipedia.org/wiki/OpenVMS https://en.wikipedia.org/wiki/OpenVMS Note: Individual systems with good security architecture & reliability. Clustering released in 80's with up to 90 nodes at hundreds of miles w/ uptime up to 17 years. Rolling upgrades, fault-tolerance, versioned filesystem using "records," integrated DB, clear commands, consistent design, and great cross-language support since all had to support calling convention and stuff. Used in mainframe-style apps, UNIX-style, real-time, and so on. Declined, pulled off market, and recently re-released. Genera LISP environment http://www.symbolics-dks.com/Genera-why-1.htm http://www.symbolics-dks.com/Genera-why-1.htm Note: LISP was easy to parse, had REPL, supported all paradigms, macro's let you customize it, memory-safe, incremental compilation of functions, and even update apps while running. Genera was a machine/OS written in LISP specifically for hackers with lots of advanced functionality. Today's systems still can't replicate the flow and holistic experience of that. Wish they could, with or without LISP itself. BeOS Multimedia Desktop http://birdhouse.org/beos/byte/29-10000ft/ http://birdhouse.org/beos/byte/29-10000ft/ https://www.youtube.com/watch?v=BsVydyC8ZGQ https://www.youtube.com/watch?v=BsVydyC8ZGQ Note: Article lists plenty of benefits that I didn't have with alternatives for long time and still barely do. Mainly due to great concurrency model and primitives (eg "benaphors"). Skip ahead to 16:10 to be amazed at what load it handled on older hardware. Haiku is an OSS project to try to re-create it. EROS http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf http://www.eros-os.org/papers/IEEE-Software-Jan-2002.pdf Note: Capability-secure OS that redid things like networking stacks and GUI for more trustworthyness. It was fast. Also had persistence where a failure could only loose so much of your running state. MINIX 3 and Genode-OS continue the microkernel tradition in a state where you can actually use them today. MINIX 3 has self-healing capabilities. QNX was first to pull it off with POSIX/UNIX compatibility, hard real-time, and great performance. INTEGRITY RTOS bulletproofs the architecture further with good design. SPIN OS http://www-spin.cs.washington.edu/ http://www-spin.cs.washington.edu/ Note: Coded OS in safe Modula-3 language with additions for better concurrency and type-safe linking. Could isolate apps in user-mode then link performance-critical stuff directly into the kernel with language & type system adding safety. Like Wirth & Hansen, eliminates all the abstraction gaps & inconsistency in various layers on top of that. JX OS http://www4.cs.fau.de/Projects/JX/publications/jx-sec.pdf http://www4.cs.fau.de/Projects/JX/publications/jx-sec.pdf Note: Builds on language-oriented approach. Puts drivers and trusted components in Java VM for safety. Microkernel outside it. Internal architecture builds security kernel/model on top of integrity model. Already doing well in tests. Open-source. High tech answer is probably Duffy's articles on Microsoft Midori. So, there's a summary of OS architectures that did vastly better than UNIX in all kinds of ways. They range from 1961 mainframes to 1970-80's minicomputers to 1990's-2000's desktops. In many cases, aspects of their design could've been ported with effort but just weren't. UNIX retained unsafe language, root, setuid, discretionary controls, heavyweight components (apps + pipes), no robustness throughout, GUI issues and so on. Endless problems many others lacked by design. Hope the list gives you stuff to think about or contribute to. :)
AnimalMuppet 11y ago
I believe that vezzy-fnord was saying that the unix world was not the ultimate in OS design. Therefore asking where in the unix world is better is missing the point. Off topic: How do you get an asterisk in your comment without HN flipping it into italics?
- nickpsecurity 11y ago
  Just found a brief formatting guide that say you put exactly one space after the first asterisk. asterisk space stuff in between asterisk. Let's try it: * no italics* EDIT: Ok, space is visible after first and second one disappears. Now I want to know what the commenter is doing too lol. EDIT 2: The closing asterisk reappeared after I added text after it. Stranger.
  - cthalupa 11y ago
    It's working for me because I'm only using one asterisk, but not using any special formatting. As long as I only say *Nix once, no italics...
    - nickpsecurity 11y ago
      Ohhh. Yeah, you only used it once. So using it twice is still open to experimentation. Hackers, have at it!
      - AnimalMuppet 11y ago
        Test: I want to say * nix, and then to *italicize * nix*. Result: I want to say * nix, and then to italicize nix. That also left things in italics, which I'll close now. Test 2: I want to say * nix, and then to *italicize *nix*. Result 2: I want to say * nix, and then to italicize nix. Again, this left italics on. So there doesn't seem to be a way to do what I was trying to do. This is why I said "unix" rather than, you know...
        11y ago