3 ms·
> ...it means you failed, so skip it next boot. Succeed? Remove the mark. Tada. Resiliency. Better yet, it's high time that PCs booted like (some) mobile phone
by jiggawatts 2y ago
> ...it means you failed, so skip it next boot. Succeed? Remove the mark. Tada. Resiliency.
Better yet, it's high time that PCs booted like (some) mobile phones do: there's two copies of the OS. The running copy is read-only. The other copy can only be replaced with a monolithic "image" that has is validated with a HS256-based digitally signed Merkle hash. Either the entire image is bit-for-bit valid, or it is rejected.
If booting to the new image fails twice, automatically roll back to the previous known-good image.
This isn't "hard", it isn't even that much work. Heck, Windows can already boot from WIM images and VHDX disk images! The code is already in there, it just needs to be turned on.
- MBCook 2y agoThis wasn’t an OS problem though, so that wouldn’t have helped. It was the data their module loaded which they change constantly. That would make it a very bad fit for a sealed system partition. Also I believe Apple Silicon Macs do what you suggest, at least in part. I don’t know if they can fall back after an upgrade failure but everything is validated and signed and tamper proof.
- jiggawatts 2y agoIt was a kernel-mode code issue however. The same design could be applied: customisations get put into duplicated read-only overlay images. Any boot issue automatically triggers a rollback, and a manual option is provided to roll back to the vanilla base image as well in the troubleshooting boot menu.