4 ms·

I've been on about this for years. Very few people give a shit until there is a price on not doing it. We already have 8 layers of VMs running interpreted stuff

by cjk2 3y ago

I've been on about this for years. Very few people give a shit until there is a price on not doing it. We already have 8 layers of VMs running interpreted stuff on supercomputers just to display a web page. What could possibly go wrong. Edit: Back to bare metal OS + compiled stuff is where I want to head. Go on Debian on native hardware is the most bearable stack in that space I have used.

deleted 3y ago
[deleted]
mikewarot 3y ago
The reason we have to use VMs is because our OS doesn't do it's job, securely and efficiently multiplexing the hardware. In almost all cases, it gives all of the user's authority to every single instruction the user executes. It's like forcing someone to grant a power of attorney in order to make a transaction, even it it's to buy an ice cream cone. You use a VM to make it possible to reset the state of an OS, and to limit its capabilities, so that you limit the capabilities of anything it runs.
- paulproteus 3y ago
  Does the green software conference have talks about this topic and how to fix it? That would be very interesting! (edited after posting: I read the article, and I see it's a movement, but not a conference. So same question, would love to see operating systems improvements be part of the green software movement, do you know if it is?)
- pdntspa 3y ago
  Because all that extra security makes the stack unbearable. That is why it's taken so long to converge on a solution, and yet even that still changes every few years. To say nothing of the beautiful simplicity of a device simply running instructions as given. I don't want a future in computing where I can't direct my own physical property to follow the programming I tell it to. A world where everything is a tenancy and there are security checkpoints and fine-grained access control on every block sucks in computing just as much as it does in real life.
  - mikewarot 3y ago
    Consider a wallet, with cash in it.... it's a fine grained capabilities system. We would regularly be given $0.25 (I think?) to buy milk for lunch at school in 1st grade. Heck, buy the time I was 10 or so, I'd regularly be handed $20, and go and buy cigarettes for Mom with it, while she waited with my younger sisters in the station wagon outside. No matter how confused, or forgetful, or mischievous, the maximum loss was the amount handed over the in first place. It was a far safer model than handing over a credit card. Each bill is an economic token. Its a very simple model, and any side effects from using them are immediately known. If your OS were to make it just as easy to use (grant permission to the program you're running) a specific file, or folder, or network connection, and nothing else you wouldn't need to worry about virii, worms, malware, etc... you'd have decided what to open, and by default, nothing else goes along for the ride. Replacing dialog boxes with "power boxes" that act the same, except they return a capability that the OS enforces, means that most GUI applications would behave identically, and it wouldn't require much change to the code. Command line applications, on the other hand, require a new standard and uniform way to specify files, paths, etc. Even so, that would be far, far easier than spinning up a VM every time you want to run code you don't trust.
  - RGamma 3y ago
    But it sure would be nice not having to worry about malicious code in the dependency closure of your system. This is not frequently talked about, but right now (and basically since forever) desktop computer security runs by and large on good will and I'm terrified of the times when it doesn't anymore. (Simultaneously this is a huge compliment to the programmer crowd!)
jeffbee 3y ago
> until there is a price Operating costs for information systems are already directly proportional to energy consumption. There is no further alignment of incentives required.

by cjk2 3y ago

deleted 3y ago

[deleted]

mikewarot 3y ago

The reason we have to use VMs is because our OS doesn't do it's job, securely and efficiently multiplexing the hardware. In almost all cases, it gives all of the user's authority to every single instruction the user executes. It's like forcing someone to grant a power of attorney in order to make a transaction, even it it's to buy an ice cream cone. You use a VM to make it possible to reset the state of an OS, and to limit its capabilities, so that you limit the capabilities of anything it runs.

paulproteus 3y ago
Does the green software conference have talks about this topic and how to fix it? That would be very interesting! (edited after posting: I read the article, and I see it's a movement, but not a conference. So same question, would love to see operating systems improvements be part of the green software movement, do you know if it is?)
pdntspa 3y ago
Because all that extra security makes the stack unbearable. That is why it's taken so long to converge on a solution, and yet even that still changes every few years. To say nothing of the beautiful simplicity of a device simply running instructions as given. I don't want a future in computing where I can't direct my own physical property to follow the programming I tell it to. A world where everything is a tenancy and there are security checkpoints and fine-grained access control on every block sucks in computing just as much as it does in real life.
- mikewarot 3y ago
  Consider a wallet, with cash in it.... it's a fine grained capabilities system. We would regularly be given $0.25 (I think?) to buy milk for lunch at school in 1st grade. Heck, buy the time I was 10 or so, I'd regularly be handed $20, and go and buy cigarettes for Mom with it, while she waited with my younger sisters in the station wagon outside. No matter how confused, or forgetful, or mischievous, the maximum loss was the amount handed over the in first place. It was a far safer model than handing over a credit card. Each bill is an economic token. Its a very simple model, and any side effects from using them are immediately known. If your OS were to make it just as easy to use (grant permission to the program you're running) a specific file, or folder, or network connection, and nothing else you wouldn't need to worry about virii, worms, malware, etc... you'd have decided what to open, and by default, nothing else goes along for the ride. Replacing dialog boxes with "power boxes" that act the same, except they return a capability that the OS enforces, means that most GUI applications would behave identically, and it wouldn't require much change to the code. Command line applications, on the other hand, require a new standard and uniform way to specify files, paths, etc. Even so, that would be far, far easier than spinning up a VM every time you want to run code you don't trust.
- RGamma 3y ago
  But it sure would be nice not having to worry about malicious code in the dependency closure of your system. This is not frequently talked about, but right now (and basically since forever) desktop computer security runs by and large on good will and I'm terrified of the times when it doesn't anymore. (Simultaneously this is a huge compliment to the programmer crowd!)

jeffbee 3y ago

> until there is a price Operating costs for information systems are already directly proportional to energy consumption. There is no further alignment of incentives required.