avsm

15 ms·

121.
by avsm 11y ago
(I'm a slacking OpenBSD developer and a unikernel hacker, so I guess I should respond :-) Pledging is the most usable form of priv-dropping I've seen yet in any OS, since it was designed after looking at the "flow" of ho
122.
by avsm 11y ago
> If the linux people finally make isolation secure I see no future for unikernels. You're forgetting that unikernels are a library OS and not tied to a particular hypervisor at all. MirageOS code can currently be compiled to targe
123.
by avsm 11y ago
Not in a released version, but there's very active work in trunk to make it work natively: https://github.com/ocaml/opam/compare/master...dra27:windows-build A recent demo I saw a few weeks ago had
124.
by avsm 11y ago
That's sort of the entire point. The idea is that you build datastructures using this library that operate over the three-way merge, and provide their own guarantees about merge conflicts. For instance, a weakly consistent data struct
125.
by avsm 11y ago
See also an early paper on "mergeable persistent data structures" that shows how to do this for Irmin-based Rope and Queue data structures. http://anil.recoil.org/papers/2015-jfla-irmin.pdf
126.
by avsm 11y ago
If anyone wants to see a talk about this with a few demos of various use-cases (such as the JavaScript transpilation backend, and log servers), I gave a talk at QCon NYC that just went live on InfoQ yesterday: http://www.infoq.co
127.
by avsm 11y ago
It's worth bearing in mind that the Rump Xen backend isn't well optimised at the moment, so there's quite a bit of low hanging fruit that could probably boost performance quite a lot. I think things like multi-page netfront,
128.
by avsm 11y ago
OpenBSD/sun4v already has some support for virtualisation via logical domains. See: http://www.openbsd.org/papers/eurobsdcon2011-kettenis.pdf and the ldomctl manpage here: http://www.openbsd.org/c
129.
by avsm 11y ago
The Irmin support means that the DNS/unikernel state is stored in a Git-compatible format. Tried pushing it to GitHub via cron to see what happens? :-)
130.
by avsm 11y ago
> If that's the main aim, then I don't see why they don't build their capability/crypto model into one of the unikernel OSes, specifically one of those that has the strong type safety and process isolation they are al
131.
by avsm 11y ago
Unikernels are a little different from Ethos. What unikernels need is a library interface to any underlying operating system, as opposed to a conventional syscall style interface that dynamically calls into a different privilege level. Th
132.
by avsm 11y ago
You're getting a 404 from nqsb.io? This: https://nqsb.io/nqsbtls-usenix-security15.pdf works fine for me. What browser/cache setup do you have? Does a `curl` work? I left another copy of the paper on my homepag
133.
by avsm 11y ago
Definitely working on making it available to non-OCaml applications as well. The most obvious way is by using 'tlstunnel' to act as a TLS terminator to TCP, but also via inverted Ctypes to ship a shared library and C header files
134.
by avsm 11y ago
Sadly, we're not so flush with cash that we can significantly up the prize, which was itself a donation from the user community. It was quite amusing when some kind users donated Bitcoins into the piñata though :-) We really like th
135.
by avsm 11y ago
The 8.2MB can be reduced quite significantly with some compiler improvements. Here's a breakdown: - Native code compilation still includes symbols. Stripping that reduces the size at the obvious cost of debugging ease. - When an OCaml
136.
by avsm 11y ago
The live site is now running the full type-safe TLS stack all the way down to the TCP/IP stack and Xen device drivers. If it feels a little sluggish from your browser, this is because TLS session resumption hasn't been merged in
137.
by avsm 11y ago
The wg-windows@lists.ocaml.org working group has just started this week to sort this out properly. Now that OPAM itself is fairly mature on Linux/BSD/MacOSX, we can tackle this properly. Please do feel free to join the group and g
138.
by avsm 11y ago
The interesting thing about the unikernel approach that we're discovering is how useful the portability of the resulting applications is. Because everything is structured as a graph of libraries, only a little modification can pull in
139.
by avsm 11y ago
If you'd like to see the approach we're taking at OCaml Labs in order to build multicore, read KC's blog post here: http://kcsrk.info/ocaml/multicore/2015/05/20/effects-multico... The
140.
by avsm 11y ago
> I'm most interested in seeing how jitsu and unikernels can turn the tables The useful aspect about the MirageOS unikernels is that they use the pure Xen PV interface, which has almost no dependency on qemu. No floppy or block&#x2
141.
by avsm 11y ago
I'm greatly enjoying myself by using the Chrome developer console to see how the Irmin store (which is based on a git-like model) is logging and syncing the local actions. It's intriguing that JavaScript compilation into a browser
142.
by avsm 12y ago
That's true with a TCP connection and its three-way handshake. With a shared memory vchan across two VMs, establishing a connection is less than a millisecond (if that).
143.
by avsm 12y ago
> I guess one benefit of Mirage's use of the OCaml module system is that we can experiment with multiple deployment approaches and use whichever one works best in practice. So there's nothing stopping me from running a Mirage a
144.
by avsm 12y ago
There are three ongoing efforts: 1) The Irmin Git store, which is designed to run both on Xen unikernels and in JavaScript. Thomas Leonard is working on integrating the latter, with very promising results for a React-style interface in the
145.
by avsm 12y ago
The term "OS virtualisation" is just fine here -- it refers to the support required to virtualise an operating system, which conventionally means the device driver, scheduler and memory interfaces. Providing such a layer lets any
146.
by avsm 12y ago
Thanks, this are all really helpful pointers! It's particularly useful to find Lattice, which seems to be a simpler entry point than a full CF setup.
147.
by avsm 12y ago
Note that both of the setups are quite different in how they boot unikernels. The EoX Zerg demo boots one unikernel per connection by having an HTTP proxy in the frontend spin up the VM. Magnus' version builds a static set of unikerne
148.
by avsm 12y ago
> I think the obstacle is that most folk are not prepared to give up their languages s/languages/frameworks, and I agree. One step at a time -- this work is a foundational block that we're building on, not the ultimate so
149.
by avsm 12y ago
That sort of design is what motivated Magnus' post that has been linked here. We've been laying the uniSaaS groundwork with a new Xen toolstack daemon called Jitsu ("Just in Time Summoning of Unikernels"). Here's t
150.
by avsm 12y ago
> When requested to install a second package with overlapping dependencies as a previous package, it would try reinstalling all dependencies This was unfortunately a mistake made by upstream Debian. Rather than reimplement the constrain

More ›