4 ms·

Operating system was always a vague term. Yes it's not Windows but it's a system that host user applications, seems valid to me.

StevePerkins 10y ago
> Operating system was always a vague term. Unless you're Richard Stallman, it really isn't. https://en.wikipedia.org/wiki/Operating_system https://en.wikipedia.org/wiki/Operating_system Do you have a kernel, and manage hardware? Then you're an OS. Otherwise, you're a container, or app server, or some other type of "platform". Tomcat and Jetty host user applications. They're not operating systems.
- LukeShu 10y ago
  To run it on your existing operating system, you would need to modify the Linux kernel in such a way that makes it unsuitable for running other services.[1] I'm fine viewing it as a specialized operating system built on the Linux kernel. [1]: It requires that the Linux kernel be compiled with `CONFIG_USER_NS=y`, which has multiple privilege escalation vulnerabilities, disabled by default on most distros[2]. If you turn it on, you are saying "all of the non-root code that I am running is managed by a trusted seccomp monitor process that prevents it from using user namespaces" which effectively means "all of the non-root code I'm running is running inside of Sandstorm". [2]: Many distros (Debian, Ubuntu, CentOS) actually have `CONFIG_USER_NS=y`, but patch the kernel to make it be run-time configurable via a sysctl flag (the flag set to "off" by default). This doesn't change the fact that turning it on (whether it be via a compile-time flag or a run-time flag) makes it unsuitable for normal use.
  - dsp1234 10y ago
    And Centos. $ cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) $ grep CONFIG_USER_NS /boot/config-3.10.0-327.22.2.el7.x86_64 CONFIG_USER_NS=y
    - LukeShu 10y ago
      Ok, so more distros patch it to be a run-time sysctl flag than I thought. That doesn't change the fact that turning it on (and expecting to not introduce significant vulnerabilities by doing so) is saying "I'm running a significantly different userland than the standard one."
      - kentonv 10y ago
        Ehh... I wouldn't recommend enabling it on a server that gives out shell accounts to multiple mutually non-trusting users... ... but I also wouldn't recommend operating such a server, period. Linux has too many vulnerabilities on a regular basis for it to be practical -- yes, many are userns-related, but many aren't. On a single-user desktop, enabling user namespaces is irrelevant. (User-root separation does not matter on a single-user desktop. All your sensitive data is in your home directory.) On a server machine that runs one service, again, enabling user namespaces has no significant security impact. If you are running multiple services on one machine and relying on UID separation (with no other sandboxing) for defense-in-depth, then, sure, enabling userns adds risk -- but again, disabling userns does not completely eliminate the risk.
        deleted 10y ago
        [deleted]
        catern 10y ago
        If we can't even trust UID separation to work, then the project of secure computing is hopeless. We've been working on UID separation for decades. If we can't get it right after all this time, what hope can Sandstorm possibly have of getting a new system right? Furthermore, abandoning the Unix permissions model requires us to rewrite the world. (a rewrite that, admittedly, Sandstorm has already made some great progress on) But, I think it is reasonable to trust UID separation and the Unix permissions model. Linux is not that vulnerable. With some diligence, a server can securely provide access to computational resources to multiple mutually non-trusting users, through the mechanism of Unix permissions. And it's really the only hope we have.
- nostrademons 10y ago
  Android has no kernel (it uses Linux), but most people think Android as an OS. The original MacOS didn't either (it was a collection of subroutines in ROM that user programs would call into), but was also generally considered an OS.
  - protomyth 10y ago
    Inferno was another that blurred the lines. It could be run by itself or hosted.
  - ekianjo 10y ago
    Linux is the kernel for Android. Not sure what you are talking about.
    - LukeShu 10y ago
      Exactly his point. You could just as easily say that Linux is the kernel for Sandstorm.
      - eitland 10y ago
        But unlike Android you can easily install sandstorm.io on different linux distros, in fact I don't even think there is an installable OS image available.
        LukeShu 10y ago
        There's a distro that back in the day did not have installable images; they only had a script to install it from an existing distro (I think it was Gentoo, but I'm not sure on that). Given that with Sandstorm, you are essentially replacing the standard GNU et al. userland with the Sandstorm userland (since turning on user namespaces with the standard userland would allow every user to be root), I don't think that it is unreasonable to view Sandstorm that way either.
- mikepurvis 10y ago
  ROS is Robot Operating System— it runs on top of other operating systems, like Linux, Windows, and Mac OS. But it's definitely an OS in the sense that it provides tooling, build and distribution infrastructure, plus OS-type services such as message passing APIs, standard plugin interfaces, etc.
- saynsedit 10y ago
  So are you saying operating system is a subclass of platform? I guess but that distinction doesn't seem very useful. It seems more like the term operating system has aged. I'd rather call Windows/Linux a platform instead of an operating system and indeed other people do too. Even then, some people consider it a design smell to consider software a platform. Long story short, semantic arguments aren't interesting and there's no logical argument against calling Sandstorm an operating system.

StevePerkins 10y ago

> Operating system was always a vague term. Unless you're Richard Stallman, it really isn't. https://en.wikipedia.org/wiki/Operating_system https://en.wikipedia.org/wiki/Operating_system Do you have a kernel, and manage hardware? Then you're an OS. Otherwise, you're a container, or app server, or some other type of "platform". Tomcat and Jetty host user applications. They're not operating systems.

LukeShu 10y ago
To run it on your existing operating system, you would need to modify the Linux kernel in such a way that makes it unsuitable for running other services.[1] I'm fine viewing it as a specialized operating system built on the Linux kernel. [1]: It requires that the Linux kernel be compiled with `CONFIG_USER_NS=y`, which has multiple privilege escalation vulnerabilities, disabled by default on most distros[2]. If you turn it on, you are saying "all of the non-root code that I am running is managed by a trusted seccomp monitor process that prevents it from using user namespaces" which effectively means "all of the non-root code I'm running is running inside of Sandstorm". [2]: Many distros (Debian, Ubuntu, CentOS) actually have `CONFIG_USER_NS=y`, but patch the kernel to make it be run-time configurable via a sysctl flag (the flag set to "off" by default). This doesn't change the fact that turning it on (whether it be via a compile-time flag or a run-time flag) makes it unsuitable for normal use.
- dsp1234 10y ago
  And Centos. $ cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) $ grep CONFIG_USER_NS /boot/config-3.10.0-327.22.2.el7.x86_64 CONFIG_USER_NS=y
  - LukeShu 10y ago
    Ok, so more distros patch it to be a run-time sysctl flag than I thought. That doesn't change the fact that turning it on (and expecting to not introduce significant vulnerabilities by doing so) is saying "I'm running a significantly different userland than the standard one."
    - kentonv 10y ago
      Ehh... I wouldn't recommend enabling it on a server that gives out shell accounts to multiple mutually non-trusting users... ... but I also wouldn't recommend operating such a server, period. Linux has too many vulnerabilities on a regular basis for it to be practical -- yes, many are userns-related, but many aren't. On a single-user desktop, enabling user namespaces is irrelevant. (User-root separation does not matter on a single-user desktop. All your sensitive data is in your home directory.) On a server machine that runs one service, again, enabling user namespaces has no significant security impact. If you are running multiple services on one machine and relying on UID separation (with no other sandboxing) for defense-in-depth, then, sure, enabling userns adds risk -- but again, disabling userns does not completely eliminate the risk.
      - deleted 10y ago
        [deleted]
      - catern 10y ago
        If we can't even trust UID separation to work, then the project of secure computing is hopeless. We've been working on UID separation for decades. If we can't get it right after all this time, what hope can Sandstorm possibly have of getting a new system right? Furthermore, abandoning the Unix permissions model requires us to rewrite the world. (a rewrite that, admittedly, Sandstorm has already made some great progress on) But, I think it is reasonable to trust UID separation and the Unix permissions model. Linux is not that vulnerable. With some diligence, a server can securely provide access to computational resources to multiple mutually non-trusting users, through the mechanism of Unix permissions. And it's really the only hope we have.
nostrademons 10y ago
Android has no kernel (it uses Linux), but most people think Android as an OS. The original MacOS didn't either (it was a collection of subroutines in ROM that user programs would call into), but was also generally considered an OS.
- protomyth 10y ago
  Inferno was another that blurred the lines. It could be run by itself or hosted.
- ekianjo 10y ago
  Linux is the kernel for Android. Not sure what you are talking about.
  - LukeShu 10y ago
    Exactly his point. You could just as easily say that Linux is the kernel for Sandstorm.
    - eitland 10y ago
      But unlike Android you can easily install sandstorm.io on different linux distros, in fact I don't even think there is an installable OS image available.
      - LukeShu 10y ago
        There's a distro that back in the day did not have installable images; they only had a script to install it from an existing distro (I think it was Gentoo, but I'm not sure on that). Given that with Sandstorm, you are essentially replacing the standard GNU et al. userland with the Sandstorm userland (since turning on user namespaces with the standard userland would allow every user to be root), I don't think that it is unreasonable to view Sandstorm that way either.
mikepurvis 10y ago
ROS is Robot Operating System— it runs on top of other operating systems, like Linux, Windows, and Mac OS. But it's definitely an OS in the sense that it provides tooling, build and distribution infrastructure, plus OS-type services such as message passing APIs, standard plugin interfaces, etc.
saynsedit 10y ago
So are you saying operating system is a subclass of platform? I guess but that distinction doesn't seem very useful. It seems more like the term operating system has aged. I'd rather call Windows/Linux a platform instead of an operating system and indeed other people do too. Even then, some people consider it a design smell to consider software a platform. Long story short, semantic arguments aren't interesting and there's no logical argument against calling Sandstorm an operating system.