3 ms·
The need for VMs or containers for security (on end user machines) is the fallout of insufficient OS security mechanisms. A better solution would be a desktop
by the_duke 6y ago
The need for VMs or containers for security (on end user machines) is the fallout of insufficient OS security mechanisms.
A better solution would be a desktop OS with proper application sandboxing. Mac OS is taking many steps in that direction.
Linux - as usual - has a multitude of solutions, all of them problematic. (AppArmor, SeLinux, Firejail, Snap, Flatpak)
- millerm 6y agoI believe the real problem is that devs install random binaries, or modules, without any real concern for what malicious activities, even if unintentional, these artifacts may perform. Forget the fact that it’s on the dev’s machine, they move this stuff into production without proper security vetting. Many devs just blindly install things from npm, copy random snippets from GitHub gists, execute remote shell scripts via curl that they just copy and paste into the terminal because they read it in some blog post, and on and on. Anyway, just my worthless < 2 cents.
- wongarsu 6y agoMicrosoft tried to push for a better model in the Windows Store apps. But the world reacted with apathy. Now they seem to try to leverage their built-in hypervisor instead, for example with Sandbox [1] for temporary VMs with minimal overhead. 1: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- m463 6y agoI believe VMs are not just for security - it might be the only way to run completely different operating systems (like macos on linux, or linux on windows, etc) Additionally, VMs might be a great help to complicated debugging. You can crash a VM without taking down your desktop. I'm not sure about things like kernel debugging, but it might be easier in a VM.