[Edit]Upon reflection....perhaps I've got an axe to grind? Sorry Short answer: Microkernels reduce the attack surface to a minimum Capabilities instead of

[Edit]Upon reflection....perhaps I've got an axe to grind? Sorry Short answer: Microkernels reduce the attack surface to a minimum Capabilities instead of ambient authority mean you don't have to trust code MULTICS, KeyKOS, EROS are historical examples, and now Genode and HURD are rising If it's got a GUI, it'll have "PowerBoxes" which return capabilities My OS bets on the future are currently riding on Genode[1], and GNU Hurd[2]. Both are based on microkernels, and capability based security.[3] Unlike Linux and Windows, they are not based on ambient authority[6] (the permission to access everything on behalf of the user). For applications, my bet is WebAssembly[7,8], which provides capabilities to applications on top of our existing ... mess. Unlike the "allow access to X" permission flags in your Smartphone, a Capability is something assigned at run time by the user in the process of running code. Like passing file handles to applications, instead of letting applications have default access to everything. We're only capable of having a national power grid because we have circuit breakers and fuses all the way down to the individual circuits in your house. You don't give a lamp the ability to draw all of the power of the entire grid, that would be silly. Why give all of your files to an app you just downloaded? This solution to computer security was discovered after research spawned by security problems discovered during the VietNam conflict. It was seen as too complex at the time, by association with Multics. However, in a world of mobile code and persistent network connections, it's the very basis of sanity. One of the reasons for the widespread adoption of virtualization is that it's an ersatz capabilities system. You treat your application as a whole as defaulting to only the disk images and network connections you allow the virtual machine. You can implement capabilities yourself in systems by giving out access tokens instead of passwords to users for various things. The great thing about capabilities is you can revoke them, or narrow the things they are allowed to do. For example, you can take a whole file system access, and filter it to be read only. Flickr allows the creation of capabilities called a "guest pass" that you can create to share what would otherwise be private photos. Here's one I created last year[5]. It can be revoked at any time. Blaming users, OS vendors, programming languages, Three Letter Agencies, and spending Billions of dollars to provide "CyberSecurity" are all wasted effort in my somewhat radical opinion. While we're near the idea... check out Unidirectional Networks[4]. These are network links that only transmit data in one direction by design. So you could, for example, monitor the flow of oil through pipelines, or status of a server farm, remotely with no possibility of control ingress. You put a pair of servers on the network, one inside that monitors the stautus and continually broadcasts it to the other outside that monitors it and lets users connect with conventional UIs. Letting the laws of physics keep hackers out is a good idea. [1] https://genode.org/index https://genode.org/index [2] https://www.gnu.org/software/hurd/ https://www.gnu.org/software/hurd/ [3] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security [4] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security [5] https://www.flickr.com/photos/---mike---/shares/1M49EfNL43/ https://www.flickr.com/photos/---mike---/shares/1M49EfNL43/ [6] https://en.wikipedia.org/wiki/Ambient_authority https://en.wikipedia.org/wiki/Ambient_authority [7] https://en.wikipedia.org/wiki/WebAssembly https://en.wikipedia.org/wiki/WebAssembly [8] https://webassembly.org/ https://webassembly.org/