5 ms·
QubesOS is dealing with the problem you describe. It implements security through isolation. But the vulnerabilities in CPU break everything.
by fghtr 9y ago
QubesOS is dealing with the problem you describe. It implements security through isolation. But the vulnerabilities in CPU break everything.
- lazyjones 9y agoThe approach is helpful, perhaps not very practical (do I maintain N different browser installations in my qube for N different tasks, or is it a single installation where malware can therefore affect all qubes?). But remember that OS and libraries have plenty of bugs too.
- nine_k 9y agoI suppose that an OS running transparently on an actual cluster of many independent cores, not linked even by a common L2 cache, could allow to separate security domains much more reliably. Single-thread performance would suffer, though, unless you're ready to pay quite a lot. And it's still hugely important in many cases.
- harlanji 9y agoThere is a Linux scheduler option for cpuset accessible via cgroups iirc, that pins execution to a set of cores. I've not used it.