4 ms·

I know this is me coming from my spoiled perspective of Linux and macOS, but the advice of running a VM that manages the WiFi hardware and passing it back to th

I know this is me coming from my spoiled perspective of Linux and macOS, but the advice of running a VM that manages the WiFi hardware and passing it back to the OS seems insane to me

Firerouge 8mo ago
Qubes OS is the Linux version of this concept. Hardware and their drivers get VMs for security boundary isolation.
skydhash 8mo ago
Computers are so complicated right now that they're literally a network of computers. When you consider the closed firmware issue, using a VM is like having a small router you connect with ethernet. And I believe you could run such VM with 64MB of RAM.
josephg 8mo ago
If an OS is designed to do this from the ground up, it can be incredibly efficient. (See: SeL4). Each process on linux is essentially its own isolated virtual machine already. Linux processes just have all sorts of ambient authority - for example, to access the filesystem and network on behalf of the user which started the process. Restricting what a process can do (sandboxing it) shouldn't have any bearing on performance.
deleted 8mo ago
[deleted]
secbear 8mo ago
seems pretty solid from a security perspective actually
hoherd 8mo ago
In my experience, AI is really good at creating bloatware, which makes it doubly frustrating that it is eating up all the RAM.
- dheera 8mo ago
  Bloatware existed as soon as JavaScript became good enough to write apps in it. Text boxes are now drawn with nested DIV hells created by polyfills and layers of React crepe cake and not a simple drawRect call to draw the text box
raverbashing 8mo ago
Honestly it's not spoiled to want to use the hardware you paid for
bandrami 8mo ago
Architecturally it makes a kind of sense given the way firmware operates (a lot of your peripherals are mini-computers inside your computer)
- iszomer 8mo ago
  Yup. The smartnic's we used in a previous gpu sku is now repurposed as the head node for another storage based sku.
  - bandrami 8mo ago
    I once was looking for a write-up of running NetBSD with a specific GPU and found a write-up of running NetBSD on that GPU
jeroenhd 8mo ago
If I were to design an OS from the ground up today, that's probably the approach I'd take. Separate risky drivers off into virtual machines with limited attack surface and a controlled I/O system so that a hacked driver can't infect the rest of the system. Plus, if the code crashes, the kernel doesn't go down with it. Windows and Linux have been moving drivers towards userland to deal with kernel instability and security risks but with modern virtualisation capabilities, I think going one step further only makes sense. Windows itself is already using something called "virtualisation based security" to leverage VMs to secure the kernel and this is just the logical next step. Qubes does this stuff too, though it works with fully-featured Linux kernels rather than minimal driver interfaces, for exactly the same reasons. A hacked wifi driver may be able to inspect and redirect traffic, but it can't do much more than that, which combined with a strong VPN can protect from quite complicated attack scenarios that normal people have no other recourse against.

I know this is me coming from my spoiled perspective of Linux and macOS, but the advice of running a VM that manages the WiFi hardware and passing it back to the OS seems insane to me

Firerouge 8mo ago

Qubes OS is the Linux version of this concept. Hardware and their drivers get VMs for security boundary isolation.

skydhash 8mo ago

Computers are so complicated right now that they're literally a network of computers. When you consider the closed firmware issue, using a VM is like having a small router you connect with ethernet. And I believe you could run such VM with 64MB of RAM.

josephg 8mo ago

If an OS is designed to do this from the ground up, it can be incredibly efficient. (See: SeL4). Each process on linux is essentially its own isolated virtual machine already. Linux processes just have all sorts of ambient authority - for example, to access the filesystem and network on behalf of the user which started the process. Restricting what a process can do (sandboxing it) shouldn't have any bearing on performance.

deleted 8mo ago

[deleted]

secbear 8mo ago

seems pretty solid from a security perspective actually

hoherd 8mo ago

In my experience, AI is really good at creating bloatware, which makes it doubly frustrating that it is eating up all the RAM.

dheera 8mo ago
Bloatware existed as soon as JavaScript became good enough to write apps in it. Text boxes are now drawn with nested DIV hells created by polyfills and layers of React crepe cake and not a simple drawRect call to draw the text box

raverbashing 8mo ago

Honestly it's not spoiled to want to use the hardware you paid for

bandrami 8mo ago

Architecturally it makes a kind of sense given the way firmware operates (a lot of your peripherals are mini-computers inside your computer)

iszomer 8mo ago
Yup. The smartnic's we used in a previous gpu sku is now repurposed as the head node for another storage based sku.
- bandrami 8mo ago
  I once was looking for a write-up of running NetBSD with a specific GPU and found a write-up of running NetBSD on that GPU

jeroenhd 8mo ago

If I were to design an OS from the ground up today, that's probably the approach I'd take. Separate risky drivers off into virtual machines with limited attack surface and a controlled I/O system so that a hacked driver can't infect the rest of the system. Plus, if the code crashes, the kernel doesn't go down with it. Windows and Linux have been moving drivers towards userland to deal with kernel instability and security risks but with modern virtualisation capabilities, I think going one step further only makes sense. Windows itself is already using something called "virtualisation based security" to leverage VMs to secure the kernel and this is just the logical next step. Qubes does this stuff too, though it works with fully-featured Linux kernels rather than minimal driver interfaces, for exactly the same reasons. A hacked wifi driver may be able to inspect and redirect traffic, but it can't do much more than that, which combined with a strong VPN can protect from quite complicated attack scenarios that normal people have no other recourse against.