3 ms·
The smaller attack surface and the possibility to implement optimizations across boundaries (userspace vs kernelspace, for example) are the selling points. I'm
by jlg23 9y ago
The smaller attack surface and the possibility to implement optimizations across boundaries (userspace vs kernelspace, for example) are the selling points.
I'm not buying into this myself as of yet but at least in theory this could lead to.an "application provably correct all the way down the stack".
- amluto 9y agoWhat smaller attack surface? If you compare the attack surface of a Linux user process that is very tightly seccomped to the attack surface of a whole guest VM (with all the awkward emulation needed), it's not at all clear to me that guests are better.