3 ms·
Speaking of "better", the author mentioned that his laptop works less from battery in OpenBSD than on Linux (3.5 hours vs 5 hours) and applications run slower.
by nuccy 7y ago
Speaking of "better", the author mentioned that his laptop works less from battery in OpenBSD than on Linux (3.5 hours vs 5 hours) and applications run slower. Unless there is a problem with OpenBSD drivers or CPU governing profiles, for me it means "worse" actually.
I was always curious why we don't have a simplified kernel for desktop/laptop use. I imagine 90% of people are running their computers in almost single user mode. E.g. at the moment my Debian, except my main username, also runs programs as root, systemd*, Debian-gdm, messagebus, some of which might be merged either with root, or with my main account. All the security features of the kernel (OpenBSD or Linux) are actually not used that much, so we could in principle make software faster and battery life longer just by "optimizing" that features. Same is true for clusters, VM hosts, embedded Linux.
It seems we overkill with security, providing fake sense of protection, while giving up on important metrics: execution time, battery life, memory usage, bandwidth, etc. At the moment the biggest security concern of mine is not the services running on my laptop in background, even with open tcp/udp ports, but the fact that my browser is running under the same username, which I use to access ssh keys, ssh-agent sockets in /tmp, password manager's files, photos, etc. Browser executes arbitrary code from the unknown to me sources all the time and one day someone will break the sandbox-ing and copy my files out.
- fpoling 7y agoI use containers on my development machine to limit the damage that can be done when I fall victim to malware stuffed into development package. Surely it will not stop a targeted attack. But a generic malware does not bother yet to try to escape from containers. So it does give some protection. Surely using VM will give even better protection while allowing for simpler kernel, but as the compilation requires up to 16GB or RAM and may take up to 2 hours, using VM will add an overhead that I cannot afford.
- tgragnato 7y agoAre you arguing in favour of MAC-frameworks or capability-based kernels? Because if you'd like MAC both Linux and OpenBSD have them. The post mentions the unveil[1] syscall, Linux has the Security Modules[2]. If you'd like capability-based kernels instead, then you're wishing for Zircon[3] to get traction. [1]: https://man.openbsd.org/unveil https://man.openbsd.org/unveil [2]: https://www.kernel.org/doc/html/latest/admin-guide/LSM/index.html https://www.kernel.org/doc/html/latest/admin-guide/LSM/index... [3]: https://fuchsia.googlesource.com/zircon https://fuchsia.googlesource.com/zircon