7 ms·

Debating whether things should be in process or out of process just seems so 80s. Ideally everything would just be in a single process. Why are new systems expo

Debating whether things should be in process or out of process just seems so 80s. Ideally everything would just be in a single process. Why are new systems exposing the ability to dereference raw pointers to user programs? There was a brief period in the 00s where it seemed like systems research was moving in the direction of only running safe code, obsoleting the need for hardware isolation. Rust proves it’s possible to do efficiently. One day we’ll get there.

kaba0 5y ago
What is only running safe code? How could then we build a browser with JIT compilation?
- SigmundA 5y ago
  First thing that comes to mind is the approach that Jurassic javascript [1] does using .Net IL generation, run that on a .Net based OS like Singularity [2]. 1. https://github.com/paulbartrum/jurassic https://github.com/paulbartrum/jurassic 2. https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system)
  - kaba0 5y ago
    So just run a different JIT compiler? Also, the Jurassic name is quite funny when talking about security :D
    - SigmundA 5y ago
      The point is your jitting to an intermediate language thats verified and a system level jit actually turns that into machine code, you are never allowed to write machine code directly to memory and execute. V8 basically does this internally with its bytecode, if your whole system was built on that bytecode then you can do software isolation rather than hardware.
  - CyberRabbi 5y ago
    Inferno is another example of a system that did not expose the ability to dereference raw pointers to user programs: https://en.m.wikipedia.org/wiki/Inferno_(operating_system) https://en.m.wikipedia.org/wiki/Inferno_(operating_system)
posix_me_less 5y ago
> Ideally everything would just be in a single process. Any real example where this makes sense on an internet-connected device?
- CyberRabbi 5y ago
  JavaScript
brmgb 5y ago
> Rust proves it’s possible to do efficiently. One day we’ll get there. Rust is only memory-safe and only as long as you stay away from unsafe code. It is not magic pixie dust.
IshKebab 5y ago
Processes provide better security isolation than just language based security (I think that's what you're talking about). For example with Spectre vulnerabilities they only work within a process (at least the original ones). There are OSes that use the language for safety and have a single process but having to use memory safe languages is a pretty big limitation! Plus I would imagine it is easier to prove process security than language security.
- ptrwis 5y ago
  Security was not the goal for software-isolated processes, but performance and getting rid of task-switches. Who knows, maybe this is what MS recently described as "next windows" (naive hope).
  - pjmlp 5y ago
    While WinDev keeps pushing their C++ agenda that hope is definitly naive.
pjmlp 5y ago
We have learned that multiprocessing is the only safe path to program stability, ease of scaling across clusters and less security exploits.
- SigmundA 5y ago
  You still have processes, they just are software isolated rather than hardware isolated. You write everything in a language that can guarantee no unsafe behavior then no hardware checks are needed or any task switching and most of the safety checks are done at compile time: https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system)
  - pjmlp 5y ago
    Singularity has a C++ microkernel actually. https://github.com/lastweek/source-singularity/tree/master/base/Kernel/Native https://github.com/lastweek/source-singularity/tree/master/b... Microsoft and Oracle have removed CAS and JAAS from CLR/JVM respectively as they have failed to provided the software isolated model that was expected from them.
    - SigmundA 5y ago
      "The lowest-level x86 interrupt dispatch code is written in assembly language and C. Once this code has done its job, it invokes the kernel, which runtime system and garbage collector are written in Sing# (an extended version of Spec#, itself an extension of C#) and runs in unprotected mode. The hardware abstraction layer is written in C++ and runs in protected mode." The point is that drivers and apps are managed code and can be software isolated, obviously some of the kernel is unsafe. CAS was fined grain runtime model that added significant overhead and was never close to being verified, software isolation was coarse grained just like a hardware process and had much less overhead with the goal of verification, more here: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/EuroSys2007_SealedProcesses.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
plerpin 5y ago
Everything in a single process? Assuming that everything running on the computer is benevolent is a very "so 80s" notion. Rust programmers use unsafe escape hatches all the time BTW.
- CyberRabbi 5y ago
  Software isolation, the subject of my comment, was not common in the 80s. You’re referring to systems that had no isolation at all.
staticassertion 5y ago
I don't really agree, as someone who advocates for Rust usage. > Ideally everything would just be in a single process. Processes are an amazing boundary, probably the most powerful abstraction in existence. > Why are new systems exposing the ability to dereference raw pointers to user programs? This shouldn't be possible today - SMAP/SMEP are standard now. > obsoleting the need for hardware isolation I think if the last 3 years (sidechannel frenzy) has taught us anything, it's that software-isolation is extremely difficult. Even hardare isolation is difficult.

kaba0 5y ago

What is only running safe code? How could then we build a browser with JIT compilation?

SigmundA 5y ago
First thing that comes to mind is the approach that Jurassic javascript [1] does using .Net IL generation, run that on a .Net based OS like Singularity [2]. 1. https://github.com/paulbartrum/jurassic https://github.com/paulbartrum/jurassic 2. https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system)
- kaba0 5y ago
  So just run a different JIT compiler? Also, the Jurassic name is quite funny when talking about security :D
  - SigmundA 5y ago
    The point is your jitting to an intermediate language thats verified and a system level jit actually turns that into machine code, you are never allowed to write machine code directly to memory and execute. V8 basically does this internally with its bytecode, if your whole system was built on that bytecode then you can do software isolation rather than hardware.
- CyberRabbi 5y ago
  Inferno is another example of a system that did not expose the ability to dereference raw pointers to user programs: https://en.m.wikipedia.org/wiki/Inferno_(operating_system) https://en.m.wikipedia.org/wiki/Inferno_(operating_system)

posix_me_less 5y ago

> Ideally everything would just be in a single process. Any real example where this makes sense on an internet-connected device?

CyberRabbi 5y ago
JavaScript

brmgb 5y ago

> Rust proves it’s possible to do efficiently. One day we’ll get there. Rust is only memory-safe and only as long as you stay away from unsafe code. It is not magic pixie dust.

IshKebab 5y ago

Processes provide better security isolation than just language based security (I think that's what you're talking about). For example with Spectre vulnerabilities they only work within a process (at least the original ones). There are OSes that use the language for safety and have a single process but having to use memory safe languages is a pretty big limitation! Plus I would imagine it is easier to prove process security than language security.

ptrwis 5y ago
Security was not the goal for software-isolated processes, but performance and getting rid of task-switches. Who knows, maybe this is what MS recently described as "next windows" (naive hope).
- pjmlp 5y ago
  While WinDev keeps pushing their C++ agenda that hope is definitly naive.

pjmlp 5y ago

We have learned that multiprocessing is the only safe path to program stability, ease of scaling across clusters and less security exploits.

SigmundA 5y ago
You still have processes, they just are software isolated rather than hardware isolated. You write everything in a language that can guarantee no unsafe behavior then no hardware checks are needed or any task switching and most of the safety checks are done at compile time: https://en.wikipedia.org/wiki/Singularity_(operating_system) https://en.wikipedia.org/wiki/Singularity_(operating_system)
- pjmlp 5y ago
  Singularity has a C++ microkernel actually. https://github.com/lastweek/source-singularity/tree/master/base/Kernel/Native https://github.com/lastweek/source-singularity/tree/master/b... Microsoft and Oracle have removed CAS and JAAS from CLR/JVM respectively as they have failed to provided the software isolated model that was expected from them.
  - SigmundA 5y ago
    "The lowest-level x86 interrupt dispatch code is written in assembly language and C. Once this code has done its job, it invokes the kernel, which runtime system and garbage collector are written in Sing# (an extended version of Spec#, itself an extension of C#) and runs in unprotected mode. The hardware abstraction layer is written in C++ and runs in protected mode." The point is that drivers and apps are managed code and can be software isolated, obviously some of the kernel is unsafe. CAS was fined grain runtime model that added significant overhead and was never close to being verified, software isolation was coarse grained just like a hardware process and had much less overhead with the goal of verification, more here: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/EuroSys2007_SealedProcesses.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...

plerpin 5y ago

Everything in a single process? Assuming that everything running on the computer is benevolent is a very "so 80s" notion. Rust programmers use unsafe escape hatches all the time BTW.

CyberRabbi 5y ago
Software isolation, the subject of my comment, was not common in the 80s. You’re referring to systems that had no isolation at all.

staticassertion 5y ago

I don't really agree, as someone who advocates for Rust usage. > Ideally everything would just be in a single process. Processes are an amazing boundary, probably the most powerful abstraction in existence. > Why are new systems exposing the ability to dereference raw pointers to user programs? This shouldn't be possible today - SMAP/SMEP are standard now. > obsoleting the need for hardware isolation I think if the last 3 years (sidechannel frenzy) has taught us anything, it's that software-isolation is extremely difficult. Even hardare isolation is difficult.