> How about secure virtualization and security through isolation instead? See Qubes OS. yeah, that's kinda what i meant by "something like this that builds on

> How about secure virtualization and security through isolation instead? See Qubes OS. yeah, that's kinda what i meant by "something like this that builds on existing primitives to get there may be the only real, feasible thing". it looks like qubes uses vms as an existing (heavyweight) primitive to limit blast radii for existing software and systems. i wonder if you can do better if you start from scratch.