4 ms·
It's not a worthwhile project when 99% of your vulnerabilities are in the software and nearly all of them need you to run untrusted software to be exploited. "
by lazyjones 9y ago
It's not a worthwhile project when 99% of your vulnerabilities are in the software and nearly all of them need you to run untrusted software to be exploited.
"Browsing the web" is not likely to become a task that can satisfy high security requirements ever again. Too much cruft gets added to browsers faster than it can be thoroughly audited.
If you need absolutely no CPU bugs (including bad design decisions "working as intended"), take a well-understood, possibly older design like 680x0 or MIPS and run it on an FPGA.
- fghtr 9y agoQubesOS is dealing with the problem you describe. It implements security through isolation. But the vulnerabilities in CPU break everything.
- lazyjones 9y agoThe approach is helpful, perhaps not very practical (do I maintain N different browser installations in my qube for N different tasks, or is it a single installation where malware can therefore affect all qubes?). But remember that OS and libraries have plenty of bugs too.
- nine_k 9y agoI suppose that an OS running transparently on an actual cluster of many independent cores, not linked even by a common L2 cache, could allow to separate security domains much more reliably. Single-thread performance would suffer, though, unless you're ready to pay quite a lot. And it's still hugely important in many cases.
- harlanji 9y agoThere is a Linux scheduler option for cpuset accessible via cgroups iirc, that pins execution to a set of cores. I've not used it.