8 ms·
The Ethos Operating System
- zenbowman 13y agoI love this. These kinds of large, moonshot projects are exactly what university research labs need to work on to move us forward.
- GauntletWizard 13y agoI love this. These projects almost certainly ultimately fail, get laughed at, and then end up educating us anyway, whether for what to do or what not to do. I expect I'll probably see some hilarious things from it early on, laugh at it's idealism and mistakes, and in 10 years I'll be using tech designed by it's apostles.
- serf 13y agoreminds me of Plan9. We all talk about how silly it is and has been for years, while simultaneously extolling the values behind the development ideas that Plan 9 follows, and the good practices it teaches in regards to OS development.
- chao- 13y agoNo one I know, who knows enough about systems to know what Plan9 is, looked so little into the details such that they find it "silly".
- pigeons 13y agowho calls Plan9 silly?
- jeffdavis 13y agoIt's named after a movie dubbed by some as the worst movie ever made. So I think it's fair to call it "silly", regardless of its more serious virtues.
- andrewflnr 13y agoSo you're saying its creators think it's silly? It has a sense of humor, apparently, but I don't think that's the sense of "Plan 9 is silly" the GP is asking about, or even related to it.
- JonSolworth 13y agoOf course, we've been told that a clean-slate design is doomed to failure. But we believe that all traditional OSs have failed and are unfixable. If this is the case, there really is no alternative to clean slate.
- macrael 13y ago"The need which will drive new OS adoption is security." Regardless as to wether or not Ethos is the next widespread OS, that line rings very true.
- kkowalczyk 13y agoIt's actually very false. "Security" is an invisible quality, by which I mean it cannot be easily observed and because of that it cannot be easily compared and because of that is not going to drive adoption. This is in contrast to visible qualities: price, performance, availability of the source code and its licensing terms, size of the ecosystem (number of applications for the OS, number of books, articles, conferences, programmers who know how to program for it) etc. How exactly will you demonstrate that Ethos is more secure than, say, OpenBSD?
- Rusky 13y agoAgreed- a new, more secure OS will need other good qualities to actually market itself on. One idea that could improve both security and the ecosystem would be a capability based design. Separating components through standard protocols/interfaces could enable something like current mobile permissions to be backed by different implementations (including virtualized/sandboxed ones), in some cases swapped out by users like commands in a shell pipeline. I haven't seen much work in this direction; does anybody think this would or wouldn't work?
- sept 13y agoSome related work here: http://sandstorm.io http://sandstorm.io http://kentonv.github.io/capnproto/ http://kentonv.github.io/capnproto/ http://plash.beasts.org/powerbox.html http://plash.beasts.org/powerbox.html http://css.csail.mit.edu/mylar/ http://css.csail.mit.edu/mylar/ https://www.meteor.com https://www.meteor.com For web-based service pipelines under user control: http://pfraze.github.io http://pfraze.github.io
- dkarapetyan 13y agoI don't think number of applications is a big deal when it comes to stuff like this. As long as it has a secure network stack and implementations of various servers for core internet infrastructure it's good enough for me. Now if you were talking about consumer grade operating systems then it would matter.
- ansible 13y agoI looked around a bit, but I couldn't find a good introduction to the design principals and such. Is there a good overview in one of the papers?
- mahmud 13y agoThe research papers are there. There is even a paper reading group. The project appears to be the synthesis of a few "attractive" design choices, combined into one. So each of those things has its own paper(s). Not uncommon in computing.
- sept 13y agoThere's a 280MB .webm video from CCC Dec 2013, linked here: https://twitter.com/jonsolworth/status/451359584376995840 https://twitter.com/jonsolworth/status/451359584376995840
- sept 13y ago2013 thesis paper has useful background: https://www.flyn.org/publications/2013-Petullo-Dissertation.pdf https://www.flyn.org/publications/2013-Petullo-Dissertation....
- JonSolworth 13y agoWriting up the design principals of Ethos is one of my goals this summer. The short description is: (1) Strong security services (authentication, authorization, encryption, isolation) (2) Higher level, less error prone semantics for all OS interaction. (3) Security guarantees derived from system layering (4) Highly composable semantics Note that only (1) deals with security-specific code. The rest deals with overall code quality.
- chewbacha 13y agoAnytime something restricts contributions based on academics I feel a little sad. This should be completely open, not just to college researchers and PhDs.
- dkarapetyan 13y agoWell they kinda need to get grants so keeping it a little closed up for publishing research isn't necessarily bad. It does mention that they plan to open it up.
- sept 13y agoFormer lead kernel developer for Ethos has released source for OpenXCI: http://comments.gmane.org/gmane.comp.emulators.xen.user/82080 http://comments.gmane.org/gmane.comp.emulators.xen.user/8208... http://article.gmane.org/gmane.comp.emulators.xen.user/81902/match= http://article.gmane.org/gmane.comp.emulators.xen.user/81902... Related OSS projects are http://qubes-os.org http://qubes-os.org and http://genode.org/ http://genode.org/
- JonSolworth 13y agoDefinitely, we are starting to open it up, encourage open source developers to get involve, and to encourage wide-spread use. If you are interested in getting involved, I'd like to hear from you. When we do release, we want the software to represent both the Tao of Ethos and to be accessible for experimentation. We are working assiduously towards that goal.
- nroose 13y agoI guess the ethos OS will not support any windows less than 1280 px wide.
- JasonFruit 13y agoI'm sure there's something I'm not getting here. Can you explain?
- jude- 13y agoSo, I read a few of the papers. I'm hoping the Ethos OS folks are on this forum, since I have a couple questions and concerns. First, my current understanding of the OS: Networking TL;DR: Their protocol is called MinimaLT, and it effectively replaces TCP/IP. Traffic sent through a MinmaLT channel is encrypted and MAC'ed by the OS. Each user has a public key, which gets submitted to the remote host for each MinimaLT channel. The public key identifies processes belonging to that user on both endpoints. The user can generate a new public/private key as often as once per connection to allow for anonymity. The OS maintains one channel per host-to-host tunnel, and multiplexes it across applications. Key management TL;DR: There exists an organization-wide key directory service and ephemeral key upload service. Servers register and re-distribute their ephemeral keys to their local key upload service, which synchronizes them with the directory service. Clients connect to their local directory service to get the ephemeral keys for other servers. The system scales up by piggybacking on DNSSEC--the directory service delivers its local servers' ephemeral keys to other directory services outside the organization by embedding them in short-lived DNS records (which then get cached). Questions: * It's not clear to me how a server comes to trust a user's public key. Is it trust-on-first-use? If so, how does a user revoke the public key? For example, if Mal stole Alice's key, now Bob's server thinks Mal's actions are from Alice. What do Bob and Alice do then? * It's not clear to me how the directory service and key upload service come to trust a local server. Is looks like this is something the local admin has to do manually? Concerns: * I'm not sure if this is more secure; in fact, I think it's less secure than SSL. The authenticity and integrity of ephemeral server public keys are backed by DNSSEC's security. So, this scheme effectively replaces a bunch of (presumably) independent TLS CAs with just one: the DNS root. You can bet the NSA has the private key. * I don't like how the network architecture couples key distribution to name resolution, which I view as orthogonal concerns. This design puts both under the control of the same administative entity, which makes it easy for that administrative entity to trick clients into communicating with the wrong servers. * MinimaLT isn't amenable to content caching. How does a CDN know that two ciphertexts are really e.g. the same image file? If it can tell, then the CDN can break your end-to-end encryption. If it can't tell, then the origin server can't scale.
- chetanahuja 13y agoAs discussed in many, many other OpenSSL related posts here in the last few days, it's becoming pretty clear that any "open-to-public" PKI system will practically be required to be built on a third-party trust system (as also discussed, PGP WOT system also reduces to a third-party trust system when it comes under attack). @jude- How else would you solve this problem if not through one or the other third party trust based PKI?
- dgreensp 13y agoToday's software requires constant patches to "stay" secure. If you stop patching your OpenSSL or your Windows XP, its security will degrade -- but the software is the same; all that's changed is some hacker was able to construct an MS Paint file that executes arbitrary code, or some other ridiculous nonsense. Large software systems will always have bugs and be difficult to understand in their entirety, but they could be made orders of magnitude easier to secure by not giving every line of code the potential to compromise the system.
- mattdeboard 13y agoOk, surely, after 5 hours and 37 comments I cannot be the only one who wondered if this was a commercialization of LosethOS. Right?
- userbinator 13y agoThe naming is rather coincidental, as is the fact that it appears to be based on principles that are the exact opposite of LoseThos.
- eitally 13y agoThat was my immediate thought, too, and I spent a good ten minutes on their site trying to figure out the connection and determine whether I was correct or not.
- pjmlp 13y agoIt would be nice if people did not reuse operating systems names: Insight ETHOS: On Object-Orientation in Operating Systems (1992) http://e-collection.library.ethz.ch/eserv/eth:38713/eth-38713-02.pdf http://e-collection.library.ethz.ch/eserv/eth:38713/eth-3871...
- deleted 13y ago[deleted]
- peterwwillis 13y ago> We need a well-designed API Nobody can agree on what that is. > as simple as possible Turn an incredibly complex operation into a simple one? Assuming we could make it sufficiently simple, what do you do when someone needs a new simple feature like pinging? > we need multiple independent quality implementations of that API Where are all the experienced cryptographers waiting in the wings to reinvent your wheel five times? > if one turns out to be crap, people can switch to a better one in a matter of hours After the exploit has been found, after two years, to switch to something which might also have the same flaw? Somehow this doesn't seem like a good solution.