6 ms·

Xen's hypervisor's size is very small. Qubes is about security and trustability of the whole system. In operating systems for measuring the trustability of the

Xen's hypervisor's size is very small. Qubes is about security and trustability of the whole system. In operating systems for measuring the trustability of the system, one very important measure is the lines of the code. Xen has a smaller footprint in the hypervisor part. Additionally, Xen has a robust model isolation for the drivers. That's why they went for Xen not KVM. But boy I wish to see more seL4. It was sad to see Gnu Hurd/seL4 didn't make it.

walterbell 9y ago
Qubes mailing list thread about hypervisor choices: https://groups.google.com/forum/m/#!topic/qubes-devel/jEe4pQ2zSKo https://groups.google.com/forum/m/#!topic/qubes-devel/jEe4pQ... > It seems one major residing problem with KVM is the Linux kernel (which is large and vulnerable). A port of KVM to a thinner base layer would obviate those issues.
- nickpsecurity 9y ago
  One of the trends I told Joanna about (i.e secure L4 kernels) led to folks developing exactly that. It was called KVM-L4. Here you go. http://os.inf.tu-dresden.de/papers_ps/liebergeld-diplom.pdf http://os.inf.tu-dresden.de/papers_ps/liebergeld-diplom.pdf Complexity was still yoo high. Most in high-assurance security were trying stuff like Nova microhypervisor as a result. KVM on separation kernels might be worth further investigation for these platforms that will stay on KVM regardless.
xyzzyz 9y ago
The problem with Xen is that no major industry player is backing it, especially with Amazon going KVM now. (disclaimer: working at Google on virtualization security)
- pjmlp 9y ago
  What about Cisco?
  - gggvvh 9y ago
    What about an Indian company selling overpriced market-segmented-to-hell shit?
    - pjmlp 9y ago
      I don't know, doing business like every other major IT company?
  - walterbell 9y ago
    Where does Cisco use Xen?
    - pjmlp 9y ago
      It has common products with Citrix for Citrix XenServer, https://blogs.cisco.com/datacenter/citrix-synergy-round-up-cisco-previews-nexus-1000v-on-xenserver https://blogs.cisco.com/datacenter/citrix-synergy-round-up-c...
- ryacko 9y ago
  Any chance Google will sponsor secure processor architecture standards? I mean, the US government no doubt had influence on the Trusted Computing Group (too bad the EFF totally shunned it), and through the magic of product binning and chip fab costs, we all have trusted platform modules. ASLR currently seems wimpy. I'm certain you are in a position to accomplish a great deal, no matter where you are in the hierarchy. Maybe the future is x86 hardware emulation for user mode processes.
  - standupstandup 9y ago
    It's Intel pushing that stuff forward, with SGX.
    - ryacko 9y ago
      Then from recent Defcon and Black Hat talks, they are an absymal failure. ( https://www.youtube.com/watch?v=lR0nh-TdpVg https://www.youtube.com/watch?v=lR0nh-TdpVg Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation ) (I don't understand it beyond what everyone says it can achieve) Intel should be considered to be totally unreliable and incompetent. I mean, no one buys office store safes and expects their things to be secure in them. But a processor is a little more expensive than a cheap safe and holds more valuable things. Edit: and besides, Fortezza is an SSL protocol option.
      - standupstandup 9y ago
        SGX is designed to shield software against SMM exploits.
      - ryacko 9y ago
        >SGX is designed to shield software against SMM exploits. Perhaps if we add one more thing, x86 will finally be secure. You are right, Intel should be left to their own devices.
        hateduser2 9y ago
- antod 9y ago
  I was under the (possibly outdated) impression that Amazon wasn't really backing Xen much anyway, so AWS changing hypervisors might not mean much to Xen anyway. I haven't used Xen for a while, but seemed to recall that Amazon forked it way back in the 3.x days and had been doing their own incompatible thing with it since then. Corrections welcome of course :)
snvzz 9y ago
>Xen's hypervisor's size is very small. 150kLoC is quite a bit for an hypervisor.
- mmrezaie 9y ago
  way smaller compared to KVM/Linux's but compared to seL4's 10k LOC it is huge which is why seL4 is a good candidate as industry standard size for trustable hypervisor layer [1] but I am not sure how and what happened to L4Linux project other than being just an academic project! https://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf https://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf

walterbell 9y ago

Qubes mailing list thread about hypervisor choices: https://groups.google.com/forum/m/#!topic/qubes-devel/jEe4pQ2zSKo https://groups.google.com/forum/m/#!topic/qubes-devel/jEe4pQ... > It seems one major residing problem with KVM is the Linux kernel (which is large and vulnerable). A port of KVM to a thinner base layer would obviate those issues.

nickpsecurity 9y ago
One of the trends I told Joanna about (i.e secure L4 kernels) led to folks developing exactly that. It was called KVM-L4. Here you go. http://os.inf.tu-dresden.de/papers_ps/liebergeld-diplom.pdf http://os.inf.tu-dresden.de/papers_ps/liebergeld-diplom.pdf Complexity was still yoo high. Most in high-assurance security were trying stuff like Nova microhypervisor as a result. KVM on separation kernels might be worth further investigation for these platforms that will stay on KVM regardless.

xyzzyz 9y ago

The problem with Xen is that no major industry player is backing it, especially with Amazon going KVM now. (disclaimer: working at Google on virtualization security)

pjmlp 9y ago
What about Cisco?
- gggvvh 9y ago
  What about an Indian company selling overpriced market-segmented-to-hell shit?
  - pjmlp 9y ago
    I don't know, doing business like every other major IT company?
- walterbell 9y ago
  Where does Cisco use Xen?
  - pjmlp 9y ago
    It has common products with Citrix for Citrix XenServer, https://blogs.cisco.com/datacenter/citrix-synergy-round-up-cisco-previews-nexus-1000v-on-xenserver https://blogs.cisco.com/datacenter/citrix-synergy-round-up-c...
ryacko 9y ago
Any chance Google will sponsor secure processor architecture standards? I mean, the US government no doubt had influence on the Trusted Computing Group (too bad the EFF totally shunned it), and through the magic of product binning and chip fab costs, we all have trusted platform modules. ASLR currently seems wimpy. I'm certain you are in a position to accomplish a great deal, no matter where you are in the hierarchy. Maybe the future is x86 hardware emulation for user mode processes.
- standupstandup 9y ago
  It's Intel pushing that stuff forward, with SGX.
  - ryacko 9y ago
    Then from recent Defcon and Black Hat talks, they are an absymal failure. ( https://www.youtube.com/watch?v=lR0nh-TdpVg https://www.youtube.com/watch?v=lR0nh-TdpVg Memory Sinkhole - Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation ) (I don't understand it beyond what everyone says it can achieve) Intel should be considered to be totally unreliable and incompetent. I mean, no one buys office store safes and expects their things to be secure in them. But a processor is a little more expensive than a cheap safe and holds more valuable things. Edit: and besides, Fortezza is an SSL protocol option.
    - standupstandup 9y ago
      SGX is designed to shield software against SMM exploits.
    - ryacko 9y ago
      >SGX is designed to shield software against SMM exploits. Perhaps if we add one more thing, x86 will finally be secure. You are right, Intel should be left to their own devices.
      - hateduser2 9y ago
antod 9y ago
I was under the (possibly outdated) impression that Amazon wasn't really backing Xen much anyway, so AWS changing hypervisors might not mean much to Xen anyway. I haven't used Xen for a while, but seemed to recall that Amazon forked it way back in the 3.x days and had been doing their own incompatible thing with it since then. Corrections welcome of course :)

snvzz 9y ago

>Xen's hypervisor's size is very small. 150kLoC is quite a bit for an hypervisor.

mmrezaie 9y ago
way smaller compared to KVM/Linux's but compared to seL4's 10k LOC it is huge which is why seL4 is a good candidate as industry standard size for trustable hypervisor layer [1] but I am not sure how and what happened to L4Linux project other than being just an academic project! https://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf https://www.sigops.org/sosp/sosp09/papers/klein-sosp09.pdf