3 ms·

It's hard to tell. My guess is: - Probably a microkernel. See also: seL4 and similar. - Largely written in a safe language, like Rust (political turmoil willi

It's hard to tell. My guess is: - Probably a microkernel. See also: seL4 and similar. - Largely written in a safe language, like Rust (political turmoil willing). - It would be UNIX-like in some fashion. - Be immutable or partially-immutable (like macOS). - Support containerization. - Be capabilities-based and support Mandatory Access Control. - Satisfies Common Criteria requirements. https://en.wikipedia.org/wiki/Common_Criteria https://en.wikipedia.org/wiki/Common_Criteria

aborsy 2y ago
I would add QubesOS like sandboxing with micro kernels.
nicecars 2y ago
Why would be UNIX-like? Is it meant to be a UNIX architecture?
- runjake 2y ago
  I'm a UNIX zealot and UNIX-like would be the most compatible with existing software for backwards compatibility. I would view the UNIX-like aspect as more of a subsystem or personality as the architecture itself is outdated, IMHO.
cookiengineer 2y ago
Add a rootless concept to it to represent the OEM state. (E.g. in MacOS where /usr/local represents user changes, if it's deleted, the OS is back in OEM state) Android actually came pretty close to this, if you ignore the vendor messups when it comes to partitioning. Due to lack of alternatives, my current "secure deployment" strategy is to use containers that have only a kernel, no shell, and "CGO_enabled=0" go binaries that don't link against C libraries. Even if they segfault it's close to impossible to guess the offsets correctly to be able to create an exploit for it. The only attack surface left is what's mounted in the container, and you have full control over that. But applying this to a desktop system is the hard part. QubedOS has nice ideas, but is unusable by unexperienced users. Something like a distro that makes it a first priority to ship apparmor and selinux profiles for every package might be a way to get there, but it's a huge load of work.
- runjake 2y ago
  Yes! I really love how ChromeOS is architected as well, even though it's not for me (power user/programmer) in its current form.

aborsy 2y ago

I would add QubesOS like sandboxing with micro kernels.

nicecars 2y ago

Why would be UNIX-like? Is it meant to be a UNIX architecture?

runjake 2y ago
I'm a UNIX zealot and UNIX-like would be the most compatible with existing software for backwards compatibility. I would view the UNIX-like aspect as more of a subsystem or personality as the architecture itself is outdated, IMHO.

cookiengineer 2y ago

Add a rootless concept to it to represent the OEM state. (E.g. in MacOS where /usr/local represents user changes, if it's deleted, the OS is back in OEM state) Android actually came pretty close to this, if you ignore the vendor messups when it comes to partitioning. Due to lack of alternatives, my current "secure deployment" strategy is to use containers that have only a kernel, no shell, and "CGO_enabled=0" go binaries that don't link against C libraries. Even if they segfault it's close to impossible to guess the offsets correctly to be able to create an exploit for it. The only attack surface left is what's mounted in the container, and you have full control over that. But applying this to a desktop system is the hard part. QubedOS has nice ideas, but is unusable by unexperienced users. Something like a distro that makes it a first priority to ship apparmor and selinux profiles for every package might be a way to get there, but it's a huge load of work.

runjake 2y ago
Yes! I really love how ChromeOS is architected as well, even though it's not for me (power user/programmer) in its current form.