6 ms·

Classic Theo: "x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has

Classic Theo: "x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582

openplatypus 9y ago
I so wish x86 would die. But that seems so improbably these days that will likely never happen.
- jstewartmobile 9y ago
  ARM has gotten very competitive recently--especially some of Apple's SoCs. I think Google is even eying it for some of their data centers. Unless the physicists find some way to breathe new life into Moore's law, I suspect we will gradually move back to the mainframe approach of implementing more and more of the low-level stuff directly in hardware.
  - userbinator 9y ago
    ARM SoCs are even more proprietary. A lot of manufacturers won't even release a datasheet (Broadcom comes to mind...)
  - hpcjoe 9y ago
    ARM isn't going to displace Intel, or more correctly, x86, any time soon. My rationale is simple, in that there are many different ARM vendors, with many different (yes) ABIs and toolchains, no real industry/market push behind any of them specifically in this space. There is no consensus ARM ABI/chip/arch to replace x86. There are a few vendors fighting, hoping to do something. But no one whom is winning this war. So x86 remains, and IMO will remain, unchallenged. Power series is a possible contender, but then you see the glory that is IBM behind it, and you know that no one wants to deal with that on the larger time scale (swap Intel for IBM? Why do this?) Sparc is all but dead. MIPS is effectively dead. I've heard good things on RISC-V, though the question is, who will want to produce a non-differentiated CPU, when others can do this as well ... that is, you can't really extend RISC-V unless you break the ISA. Then there are the toolchain issues. Having experienced the Calxeda failure as a partner, realizing that the ARM marketing claims of low power Intel replacement were complete nonsense[1], I am not all that interested in climbing back on that particular heavily hyped horse. [1] https://scalability.org/2013/12/the-evolving-market-for-hpc-part-1-recent-past/ https://scalability.org/2013/12/the-evolving-market-for-hpc-... search for ARM.
    - api 9y ago
      Why do you need one vendor? IMHO the Intel/AMD oligopoly (heavily tilted toward Intel) is one of the major problems with X86/X64. ARM32 has "ARM hell" with multiple extensions but they've mostly fixed this in ARM64. You can definitely have compatible ABIs at the level users care about, namely application binaries. Multiple vendors means price competition too. IMHO the major stumbling block for ARM64 vs. X64 is that X64 has so much existing market share. Installed user-base is very powerful and everyone knows X64 will work so why take the chance? Hardware is cheaper than IT person-hours. If someone fielded an X64-competitive ARM64 multi-core chip at a competitive price point it would probably get some traction.
- walterbell 9y ago
  OpenPower has open firmware.
tree_of_item 9y ago
Yes, but virtualization does seem to have a lot of security benefits. Theo using lots of clever words to call someone stupid isn't a refutation of this. Even if both layers have holes, the fact that there's more than one layer does, in fact, suggest the composition is more secure.
- jstewartmobile 9y ago
  I respect Rutkowska. That being said, I also think she's putting a band-aid on a festering sore most people call the PC architecture. Security guys have been going on about "defense-in-depth" for decades, and it all still looks like a trash fire to me. From a systems perspective, you don't make things more robust by adding more layers that can break. You do it by simplifying it down to something manageable, then managing it. You call it a security layer. I call it an extra attack surface.
  - jerheinze 9y ago
    Using your own reasoning one would end up with absurd conclusions such as that sandboxing shouldn't be added, "You call it a security layer. I call it an extra attack surface." Therefore your reasoning is fallacious.
    - jstewartmobile 9y ago
      My reasoning is no more fallacious than your reading comprehension. If sandboxing is necessary to make things manageable, it should be baked-in rather than being yet another moving layer inserted into the hundreds we already have. The combinatorics of PC development/security/maintenance/etc are ridiculous enough as it is.
      - jerheinze 9y ago
        You're still missing the point which is that it doesn't make it less secure (which is what you claimed), in fact, it makes it more secure.
  - 9y ago
jerheinze 9y ago
Nowhere did Rutkowska claim that hypervisors are perfect, as she says[1]: Hypervisors do not add security by themselves. But they make it possible to implement security by isolation cheaply. Cheaply means: 1) preserving backward compatibility with apps & drivers, 2) with drastically reduced attack surface due to smaller APIs. (Note that the HVM hypercall API isn't very big. Mostly physical memory ops, vCPU ops, physdev stuff, evchans and sched-related stuff.[2]) [1] : https://twitter.com/rootkovska/status/843031083398692866 https://twitter.com/rootkovska/status/843031083398692866 [2] : https://twitter.com/tehjh/status/858321760940437504 https://twitter.com/tehjh/status/858321760940437504
tptacek 9y ago
You want the rest of the list of architectural security features Theo also doesn't believe in? It's pretty long. For a very long time, Theo subscribed to the philosophy that the way to get a secure OS was to keep it as simple as POSIX and historical BSD would allow him to (and no simpler) while eradicating all the bugs. Eradicating bugs is obviously a good thing, but the track record of that strategy in the real world has not been great. That's obviously changed over the last 5 years or so, but you should be careful reflecting DeRaadt cynicism from a decade ago into modern discussions. Qubes is surely a better bet than vanilla OpenBSD.
- Danihan 9y ago
  >Qubes is surely a better bet than vanilla OpenBSD. Is there a concrete reason you believe that or just a gut feeling?
  - jerheinze 9y ago
    > Is there a concrete reason you believe that or just a gut feeling? It's pretty obvious to anyone really. Even if you assume that OpenBSD had 0 bugs, it doesn't protect you if someone exploits your browser, or some application that you have, which may have a lot of bugs. In contrast, tou can create two isolated OpenBSD VMs in Qubes, one where you do your banking related activities (and setup the firewall to only allow connections to your bank for example), and the other where you do your browsing, so that even if someone pwns your browser in the second VM they won't be able to steal your banking logging credentials - unless they have a Xen exploit of course.
    - snikeris 9y ago
      > it doesn't protect you if someone exploits your browser https://en.wikipedia.org/wiki/Address_space_layout_randomization#OpenBSD https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
      - tptacek 9y ago
        ASLR has been table stakes for over a decade.

openplatypus 9y ago

I so wish x86 would die. But that seems so improbably these days that will likely never happen.

jstewartmobile 9y ago
ARM has gotten very competitive recently--especially some of Apple's SoCs. I think Google is even eying it for some of their data centers. Unless the physicists find some way to breathe new life into Moore's law, I suspect we will gradually move back to the mainframe approach of implementing more and more of the low-level stuff directly in hardware.
- userbinator 9y ago
  ARM SoCs are even more proprietary. A lot of manufacturers won't even release a datasheet (Broadcom comes to mind...)
- hpcjoe 9y ago
  ARM isn't going to displace Intel, or more correctly, x86, any time soon. My rationale is simple, in that there are many different ARM vendors, with many different (yes) ABIs and toolchains, no real industry/market push behind any of them specifically in this space. There is no consensus ARM ABI/chip/arch to replace x86. There are a few vendors fighting, hoping to do something. But no one whom is winning this war. So x86 remains, and IMO will remain, unchallenged. Power series is a possible contender, but then you see the glory that is IBM behind it, and you know that no one wants to deal with that on the larger time scale (swap Intel for IBM? Why do this?) Sparc is all but dead. MIPS is effectively dead. I've heard good things on RISC-V, though the question is, who will want to produce a non-differentiated CPU, when others can do this as well ... that is, you can't really extend RISC-V unless you break the ISA. Then there are the toolchain issues. Having experienced the Calxeda failure as a partner, realizing that the ARM marketing claims of low power Intel replacement were complete nonsense[1], I am not all that interested in climbing back on that particular heavily hyped horse. [1] https://scalability.org/2013/12/the-evolving-market-for-hpc-part-1-recent-past/ https://scalability.org/2013/12/the-evolving-market-for-hpc-... search for ARM.
  - api 9y ago
    Why do you need one vendor? IMHO the Intel/AMD oligopoly (heavily tilted toward Intel) is one of the major problems with X86/X64. ARM32 has "ARM hell" with multiple extensions but they've mostly fixed this in ARM64. You can definitely have compatible ABIs at the level users care about, namely application binaries. Multiple vendors means price competition too. IMHO the major stumbling block for ARM64 vs. X64 is that X64 has so much existing market share. Installed user-base is very powerful and everyone knows X64 will work so why take the chance? Hardware is cheaper than IT person-hours. If someone fielded an X64-competitive ARM64 multi-core chip at a competitive price point it would probably get some traction.
walterbell 9y ago
OpenPower has open firmware.

tree_of_item 9y ago

Yes, but virtualization does seem to have a lot of security benefits. Theo using lots of clever words to call someone stupid isn't a refutation of this. Even if both layers have holes, the fact that there's more than one layer does, in fact, suggest the composition is more secure.

jstewartmobile 9y ago
I respect Rutkowska. That being said, I also think she's putting a band-aid on a festering sore most people call the PC architecture. Security guys have been going on about "defense-in-depth" for decades, and it all still looks like a trash fire to me. From a systems perspective, you don't make things more robust by adding more layers that can break. You do it by simplifying it down to something manageable, then managing it. You call it a security layer. I call it an extra attack surface.
- jerheinze 9y ago
  Using your own reasoning one would end up with absurd conclusions such as that sandboxing shouldn't be added, "You call it a security layer. I call it an extra attack surface." Therefore your reasoning is fallacious.
  - jstewartmobile 9y ago
    My reasoning is no more fallacious than your reading comprehension. If sandboxing is necessary to make things manageable, it should be baked-in rather than being yet another moving layer inserted into the hundreds we already have. The combinatorics of PC development/security/maintenance/etc are ridiculous enough as it is.
    - jerheinze 9y ago
      You're still missing the point which is that it doesn't make it less secure (which is what you claimed), in fact, it makes it more secure.
- 9y ago

jerheinze 9y ago

Nowhere did Rutkowska claim that hypervisors are perfect, as she says[1]: Hypervisors do not add security by themselves. But they make it possible to implement security by isolation cheaply. Cheaply means: 1) preserving backward compatibility with apps & drivers, 2) with drastically reduced attack surface due to smaller APIs. (Note that the HVM hypercall API isn't very big. Mostly physical memory ops, vCPU ops, physdev stuff, evchans and sched-related stuff.[2]) [1] : https://twitter.com/rootkovska/status/843031083398692866 https://twitter.com/rootkovska/status/843031083398692866 [2] : https://twitter.com/tehjh/status/858321760940437504 https://twitter.com/tehjh/status/858321760940437504

tptacek 9y ago

You want the rest of the list of architectural security features Theo also doesn't believe in? It's pretty long. For a very long time, Theo subscribed to the philosophy that the way to get a secure OS was to keep it as simple as POSIX and historical BSD would allow him to (and no simpler) while eradicating all the bugs. Eradicating bugs is obviously a good thing, but the track record of that strategy in the real world has not been great. That's obviously changed over the last 5 years or so, but you should be careful reflecting DeRaadt cynicism from a decade ago into modern discussions. Qubes is surely a better bet than vanilla OpenBSD.

Danihan 9y ago
>Qubes is surely a better bet than vanilla OpenBSD. Is there a concrete reason you believe that or just a gut feeling?
- jerheinze 9y ago
  > Is there a concrete reason you believe that or just a gut feeling? It's pretty obvious to anyone really. Even if you assume that OpenBSD had 0 bugs, it doesn't protect you if someone exploits your browser, or some application that you have, which may have a lot of bugs. In contrast, tou can create two isolated OpenBSD VMs in Qubes, one where you do your banking related activities (and setup the firewall to only allow connections to your bank for example), and the other where you do your browsing, so that even if someone pwns your browser in the second VM they won't be able to steal your banking logging credentials - unless they have a Xen exploit of course.
  - snikeris 9y ago
    > it doesn't protect you if someone exploits your browser https://en.wikipedia.org/wiki/Address_space_layout_randomization#OpenBSD https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
    - tptacek 9y ago
      ASLR has been table stakes for over a decade.