6 ms·

Why is the Linux Foundation interested in supporting a non-Linux operating system?

joezydeco 11y ago
More nodes = more backend servers?
Animats 11y ago
That's a good question. Anyone know the political background? Zephyr is for systems far too small for Linux. You don't even have to have a file system. Several of the endorsers in the press release speak of Zephyr as "secure". This OS has no memory protection, no user IDs, and no permission system. Any code can do anything. Messages are passed around as raw pointers; they're not copied. Nor is the size sent with the message. And it's all in C. What could possibly go wrong? There's nothing wrong with using an OS like this when your application program is a few hundred lines. But if you add a networking stack and a mini web server, there's going to be trouble. [1] https://www.zephyrproject.org/doc/api/api.html https://www.zephyrproject.org/doc/api/api.html
- cpeterso 11y ago
  It seems like small, custom systems like these without memory protection should at least use a safe language like Rust.
  - tosseraccount 11y ago
    The first "stable" version of the Rust, version 1.0.0, was released in May 2015 - wikipedia. Seems like Rust needs a few more laps around the track. ( Rust is from Mozilla Foundation, perhaps we can see some alternate implementations of their products to see how reliable they are with Rust ).
    - bluejekyll 11y ago
      And it's seen 6 minor releases since then. Probably more stable than this kernel.
  - SeanDav 11y ago
    C can be very safe or very unsafe, it just depends on how you use it. As a counter point: critical code for missions to Mars are written in C. http://www.verticalsysadmin.com/making_robust_software/ http://www.verticalsysadmin.com/making_robust_software/
    - obelisk_ 11y ago
      Just because expert C programmers were able to make it work doesn't mean that C is the best way to write secure code. I say this as someone who writes quite a bit of C (though I don't view myself an expert in it yet).
      - SeanDav 11y ago
        I highly doubt they just drew C out of a hat and decided to make it work for their multi million dollar, "absolutely-cannot-fail-software". They would have considered other languages out there. C was the winner.
        nickpsecurity 11y ago
        Speaking from high-assurance niche, C absolutely sucked for that in more ways than you can imagine. Like the recent NASA post, the reason they use C is tooling and available talent. Ridiculous amounts of manpower went into developing static analysis, testing, compilers, etc for C. The best talent in high assurance pretty much all know C, too, whether or not it's their default language. Almost all the hardware supports it, too. So, a combo of top talent w/ a C history and tons of tooling made most of them go with C. Many others went with Ada/SPARK. A few small fish even use typed or structured assembler. C is only chosen due to tooling and "better the devil you know" philosophy. Work on superior languages got more results with less effort in both human and mechanical reviews, though. So, the inferior language is only used due to an accident of history. Details on that here: http://pastebin.com/UAQaWuWG http://pastebin.com/UAQaWuWG
        pekk 11y ago
        Are you recommending that people switch to Ada, or Pascal, or what? Your pastebin seems to strongly favor Algol-likes. It would be nice to see some more substantive reasons why people should be using an Algol-like language in 2016. Just saying that C was originally hacked together to be expedient doesn't quite make that case.
  - zem 11y ago
    you might find this interesting: https://github.com/fpiot/arduino-ats https://github.com/fpiot/arduino-ats
- wslh 11y ago
  > What could possibly go wrong? Well, my microwave firmware doesn't have any protection either but, seriously, you can apply security models/proofs to the code you run there.
  - kbenson 11y ago
    You just made me think of what might actually be be possible if you could hack a microwave through the control pad. I'm not sure what could be accomplished with sending unrestricted commands to the hardware in a microwave, but depending on the cheapness of the components, I suspect it's not good.
    - jonathankoren 11y ago
      I think an entertaining short story could be premised on this idea.
    - schoen 11y ago
      I have a friend who succeeded in emulating a microwave using MAME and a dump of the microwave's ROM. (I don't remember exactly what all of the microcontroller outputs are; most of them have to do with the LED user interface rather than activating the magnetron.) Of course the emulated microwave can't really cook food (maybe only emulated food...), but you could use that kind of emulation with a debugger to experiment with possible software vulnerabilities. Since it was possible to reprogram Super Mario World through the controller, it seems pretty plausible that it's possible to reprogram some embedded systems through their UI even when they're not designed for that! http://hackaday.com/2015/01/22/reprogramming-super-mario-world-from-inside-the-game/ http://hackaday.com/2015/01/22/reprogramming-super-mario-wor...
      - kbenson 11y ago
        > Since it was possible to reprogram Super Mario World through the controller, it seems pretty plausible that it's possible to reprogram some embedded systems through their UI even when they're not designed for that! That's about what I was thinking. Hell, if there's a standard set of firmware that most, or even just most cheap ones ship with, then it might even work for a large chunk of the units in the wild.
- 0xdeadbeefbabe 11y ago
  Well ok, but at least the programs are few hundred lines long. I'm just saying I know that printf("hello world") will halt, and that's a good thing.
digi_owl 11y ago
Likely they are shooting for the whole unikernel craze. Cram this with some server into a VM and drop the VM on top of Linux in the cloud. Supposedly this setup provides performance vs security middle ground between containers and a full blown distro in a VM. Meaning that as there is just a minimal kernel present you get higher performance, while being wrapped in a VM reduce the potential of exploits compared to a container.
- Animats 11y ago
  No, the architecture is all wrong for this being part of a container system. This is for tiny embedded computers. Like RFID tags.
fudged71 11y ago
The Linux Foundation is focussed on creating open source consortiums, regardless of their impact on Linux.
ryao 11y ago
A kernel is not an operating system. As for the Linux Foundation, they seem to be branching out into strengthening the entire Linux ecosystem. Having Zephyr for embedded firmware on the bits not running Linux in Linux systems (e.g. sensors) is a step toward that.

More nodes = more backend servers?

That's a good question. Anyone know the political background? Zephyr is for systems far too small for Linux. You don't even have to have a file system. Several of the endorsers in the press release speak of Zephyr as "secure". This OS has no memory protection, no user IDs, and no permission system. Any code can do anything. Messages are passed around as raw pointers; they're not copied. Nor is the size sent with the message. And it's all in C. What could possibly go wrong? There's nothing wrong with using an OS like this when your application program is a few hundred lines. But if you add a networking stack and a mini web server, there's going to be trouble. [1] https://www.zephyrproject.org/doc/api/api.html https://www.zephyrproject.org/doc/api/api.html

cpeterso 11y ago
It seems like small, custom systems like these without memory protection should at least use a safe language like Rust.
- tosseraccount 11y ago
  The first "stable" version of the Rust, version 1.0.0, was released in May 2015 - wikipedia. Seems like Rust needs a few more laps around the track. ( Rust is from Mozilla Foundation, perhaps we can see some alternate implementations of their products to see how reliable they are with Rust ).
  - bluejekyll 11y ago
    And it's seen 6 minor releases since then. Probably more stable than this kernel.
- SeanDav 11y ago
  C can be very safe or very unsafe, it just depends on how you use it. As a counter point: critical code for missions to Mars are written in C. http://www.verticalsysadmin.com/making_robust_software/ http://www.verticalsysadmin.com/making_robust_software/
  - obelisk_ 11y ago
    Just because expert C programmers were able to make it work doesn't mean that C is the best way to write secure code. I say this as someone who writes quite a bit of C (though I don't view myself an expert in it yet).
    - SeanDav 11y ago
      I highly doubt they just drew C out of a hat and decided to make it work for their multi million dollar, "absolutely-cannot-fail-software". They would have considered other languages out there. C was the winner.
      - nickpsecurity 11y ago
        Speaking from high-assurance niche, C absolutely sucked for that in more ways than you can imagine. Like the recent NASA post, the reason they use C is tooling and available talent. Ridiculous amounts of manpower went into developing static analysis, testing, compilers, etc for C. The best talent in high assurance pretty much all know C, too, whether or not it's their default language. Almost all the hardware supports it, too. So, a combo of top talent w/ a C history and tons of tooling made most of them go with C. Many others went with Ada/SPARK. A few small fish even use typed or structured assembler. C is only chosen due to tooling and "better the devil you know" philosophy. Work on superior languages got more results with less effort in both human and mechanical reviews, though. So, the inferior language is only used due to an accident of history. Details on that here: http://pastebin.com/UAQaWuWG http://pastebin.com/UAQaWuWG
        pekk 11y ago
        Are you recommending that people switch to Ada, or Pascal, or what? Your pastebin seems to strongly favor Algol-likes. It would be nice to see some more substantive reasons why people should be using an Algol-like language in 2016. Just saying that C was originally hacked together to be expedient doesn't quite make that case.
- zem 11y ago
  you might find this interesting: https://github.com/fpiot/arduino-ats https://github.com/fpiot/arduino-ats
wslh 11y ago
> What could possibly go wrong? Well, my microwave firmware doesn't have any protection either but, seriously, you can apply security models/proofs to the code you run there.
- kbenson 11y ago
  You just made me think of what might actually be be possible if you could hack a microwave through the control pad. I'm not sure what could be accomplished with sending unrestricted commands to the hardware in a microwave, but depending on the cheapness of the components, I suspect it's not good.
  - jonathankoren 11y ago
    I think an entertaining short story could be premised on this idea.
  - schoen 11y ago
    I have a friend who succeeded in emulating a microwave using MAME and a dump of the microwave's ROM. (I don't remember exactly what all of the microcontroller outputs are; most of them have to do with the LED user interface rather than activating the magnetron.) Of course the emulated microwave can't really cook food (maybe only emulated food...), but you could use that kind of emulation with a debugger to experiment with possible software vulnerabilities. Since it was possible to reprogram Super Mario World through the controller, it seems pretty plausible that it's possible to reprogram some embedded systems through their UI even when they're not designed for that! http://hackaday.com/2015/01/22/reprogramming-super-mario-world-from-inside-the-game/ http://hackaday.com/2015/01/22/reprogramming-super-mario-wor...
    - kbenson 11y ago
      > Since it was possible to reprogram Super Mario World through the controller, it seems pretty plausible that it's possible to reprogram some embedded systems through their UI even when they're not designed for that! That's about what I was thinking. Hell, if there's a standard set of firmware that most, or even just most cheap ones ship with, then it might even work for a large chunk of the units in the wild.
0xdeadbeefbabe 11y ago
Well ok, but at least the programs are few hundred lines long. I'm just saying I know that printf("hello world") will halt, and that's a good thing.

digi_owl 11y ago

Likely they are shooting for the whole unikernel craze. Cram this with some server into a VM and drop the VM on top of Linux in the cloud. Supposedly this setup provides performance vs security middle ground between containers and a full blown distro in a VM. Meaning that as there is just a minimal kernel present you get higher performance, while being wrapped in a VM reduce the potential of exploits compared to a container.

Animats 11y ago
No, the architecture is all wrong for this being part of a container system. This is for tiny embedded computers. Like RFID tags.

fudged71 11y ago

The Linux Foundation is focussed on creating open source consortiums, regardless of their impact on Linux.

ryao 11y ago

A kernel is not an operating system. As for the Linux Foundation, they seem to be branching out into strengthening the entire Linux ecosystem. Having Zephyr for embedded firmware on the bits not running Linux in Linux systems (e.g. sensors) is a step toward that.