54 ms·

Yes, very familiar with that one! Not only is this one of the very few zone escapes over our years in production (responsibly disclosed, thankfully!), but the

Yes, very familiar with that one! Not only is this one of the very few zone escapes over our years in production (responsibly disclosed, thankfully!), but the bug itself was introduced by yours truly -- and is part of what gave me religion on Rust. To be clear, my assertion was not that any particular body of software is invulnerable, but rather taking issue with the assertion that zones-based infrastructure "isn't safe for multitenant untrusted workloads"; we ran exactly that for a decade. I also very much stand by my assertion that Meltdown was a greater source of vulnerability than zones -- and if one wishes to assert that a shared kernel makes zones unsafe, than one also must say that a shared microprocessor is unsafe. For some folks, that will be a completely reasonable assertion, but for most, they will understand that a shared microprocessor -- past vulnerabilities aside -- can in fact be made safe for multitenant use.

tptacek 4y ago
I don't think you should have to apologize for a 2016 Joyent bug. I also don't understand how you can coherently argue that people should have "religion about Rust", but also put their faith in C-language OS kernels any more than they have to. Further, I don't understand how Meltdown helps your argument at all here, since both isolation strategies are susceptible. Memory safety also doesn't protect you from control-plane SSRF vulnerabilities, but you can immediately see why "control-plane SSRF vulnerabilities mean memory-safety is overrated" is a bogus argument.
- bcantrill 4y ago
  I'm not arguing that people should have religion about Rust -- merely explaining that this particular issue was central to my own internalization of some of the very subtle unsafety in C. In terms of Meltdown: I am saying that -- as a practical matter -- it was much more serious for us than the extraordinarily small number of vulnerabilities we have had in zones over the years.
  - tptacek 4y ago
    People should have religion about minimizing the amount of memory-unsafe code in their attack surface.

tptacek 4y ago

I don't think you should have to apologize for a 2016 Joyent bug. I also don't understand how you can coherently argue that people should have "religion about Rust", but also put their faith in C-language OS kernels any more than they have to. Further, I don't understand how Meltdown helps your argument at all here, since both isolation strategies are susceptible. Memory safety also doesn't protect you from control-plane SSRF vulnerabilities, but you can immediately see why "control-plane SSRF vulnerabilities mean memory-safety is overrated" is a bogus argument.

bcantrill 4y ago
I'm not arguing that people should have religion about Rust -- merely explaining that this particular issue was central to my own internalization of some of the very subtle unsafety in C. In terms of Meltdown: I am saying that -- as a practical matter -- it was much more serious for us than the extraordinarily small number of vulnerabilities we have had in zones over the years.
- tptacek 4y ago
  People should have religion about minimizing the amount of memory-unsafe code in their attack surface.