14 ms·
All of them if any external party has access to that "only thing running".
by alfanick 7y ago
All of them if any external party has access to that "only thing running".
- mbreese 7y agoDo you really need something like SELinux if the “only thing running” is a network service that doesn’t have access to a file system? Even if that service was compromised, what else could be gained? Especially if the unikernel doesn’t spawn other processes. Am I missing something obvious?
- ncmncm 7y agoNo, not missing anything. Trendiness wars with actual benefit.
- nintendo1889 7y ago"the computer industry is more fashionable than the women's fashion industry" - Stallman
- x0054 7y agoNope, you are right on the money. It’s just new and different, and people don’t like new and different.
- eyberg 7y agoNot being able to spawn other processes is actually a huge security and performance benefit when you know you're deploying to a virtualized environment to begin with. (eg: cloud).
- yjftsjthsd-h 7y agoBut that's the same either way, isn't it? If an attacker compromises your application, they own the app. It doesn't matter if the app is under an OS or a VM.
- eyberg 7y agoMost (all?) attackers dont care about apps. They want access to your server to do other things. That could be downloading a monero miner or doing something as simple as mysqldump. Either way that's another program which isn't possible in a single process world such as a unikernel.