The correct place to solve these problems is at the operating system level, but that's a difficult space to break into, and so people are trying to solve adjace

The correct place to solve these problems is at the operating system level, but that's a difficult space to break into, and so people are trying to solve adjacent "containment" problems with different mechanisms like virtualization and emulation. Here's what it could look like if it were solved at the operating system level. This is a talk about the Helios microkernel, which is based on seL4. https://drewdevault.com/2023/02/20/2023-02-20-Helios-aarch64.html https://drewdevault.com/2023/02/20/2023-02-20-Helios-aarch64... The most important thing he says in the whole talk is that "Helios can run another instance of itself within itself, without virtualization". We don't need any of this extra complexity, emulating entire machines, to be secure. We just need to build applications on top of APIs which allow for security. An application that needs a few seL4 endpoints to do its job is much easier to properly integrate into a secure system, than an application which expects the whole POSIX circus.