eyberg

6 ms·

61.
by eyberg 1y ago
bubblewrap is actually worse - there are known escapes in there that haven't been fixed for years
62.
by eyberg 1y ago
I kinda see the different side of the coin. "a determined and amoral adversary" - I'd kinda disagree with this (the amoral adversary part being necessary). If you crawl through the vast data breach notification lists that man
63.
by eyberg 1y ago
A better title might be "Kees Cook's account disabled for suspected malicious activity". He isn't exactly a random contributor.
64.
Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in AppPort(blog.qualys.com)
2 points by eyberg 1y ago|0 comments
65.
by eyberg 1y ago
Cloud vms are a main target for unikernels, however, as Russ mentions in one of the linked issues there actually is quite a lot of other code you need to include in your system depending on what you are deploying to. For instance systems wi
66.
by eyberg 1y ago
Except in this case they are just running a linux payload - that which pretty much any firecracker provider could do.
67.
by eyberg 1y ago
Maybe you can clarify but this isn't actually using unikraft the kernel is it? Maybe you can clarify that this is actually running a stripped down linux as unikraft does not have the support to run chrome itself.
68.
The Stack Grows Down(nanovms.com)
2 points by eyberg 2y ago|0 comments
69.
by eyberg 2y ago
No. As I'm responding to this Qualys just announced three new bypasses as of today: https://seclists.org/oss-sec/2025/q1/253 .
70.
Three bypasses of Ubuntu's unprivileged user namespace restrictions(seclists.org)
2 points by eyberg 2y ago|0 comments
71.
by eyberg 2y ago
When we speak of 'hard security boundaries' most people, in this space, are comparing to existing hardware backed isolation such as virtual machines. There are many container escapes each year because the chunk of api that they ar
72.
Multiple Vulnerabilities in Ingress-Nginx(openwall.com)
3 points by eyberg 2y ago|0 comments
73.
by eyberg 2y ago
We definitely took inspiration and implemented in the nanos unikernel cause we think it's a great idea: https://nanovms.com/dev/tutorials/applying-sandbox-security-...
74.
Inflating the Buddy Memory Allocator(nanovms.com)
1 points by eyberg 2y ago|0 comments
75.
by eyberg 2y ago
Absolutely. Everyone who deploys unikernels to the public clouds does this. Some are better fits than others. AWS for instance you can build an image and deploy an ec2 instance in a matter of seconds.
76.
by eyberg 2y ago
Anything new is going to have people poking and prodding at it. It doesn't mean that the concept is 'bad'. Linux has desperately needed an interface like io_uring for decades. Async IO was in Windows NT 3.1 in 1993.
77.
Memory Ballooning, Unikernels, QEMU, and Firecracker Oh My(nanovms.com)
1 points by eyberg 2y ago|0 comments
78.
by eyberg 2y ago
> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff As of t
79.
LPEs in Needrestart(qualys.com)
1 points by eyberg 2y ago|0 comments
80.
by eyberg 2y ago
Firecracker boots up a runtime that has a full blown operating system in it - lambda just happens to call a known program with a known function. In that sense sure it provides similar functionality but it's really quite different. That
81.
by eyberg 2y ago
Firecracker can run ordinary linux/GPOS vms and unikernels. Unikernels can run inside of firecracker. Unikernels are focused on single applications whereas general purpose operating systems are focused on multiple applications. This is
82.
Don't Fragment My UDP Packets(nanovms.com)
2 points by eyberg 2y ago|0 comments
83.
by eyberg 2y ago
The major tradeoff with firecracker is a reduction in runtime performance for a quick boot time (if you actually need that - this obviously doesn't work if your app takes seconds to boot). There are quite a lot of other tradeoffs too l
84.
by eyberg 2y ago
There are a lot of projects that are looking at blurring the lines for systems that run databases: https://dbos-project.github.io/blog/intro-blog.html https://www.cs.cit.tum.de/fileadmin/w00cfj&#x2
85.
by eyberg 2y ago
This is a very large rationale for what we are building with https://nanos.org .
86.
by eyberg 2y ago
Nanos is the actual kernel while ops ( https://ops.city ) is the build/deploy tool. I presume you're asking if this is doing "orchestration" - that is more of a container term. These get deployed as actual vms
87.
by eyberg 2y ago
Going to toot my own horn here but if you're looking for something like a container with a security focus that is precisely what https://nanos.org was built for. No users, no login/ssh, no ability to run other programs
88.
Direct IO Comes to the Nanos Unikernel with O_direct(nanovms.com)
2 points by eyberg 2y ago|0 comments
89.
by eyberg 2y ago
I think many people (including unikernel proponents themselves) vastly underestimate the amount of work that goes into writing an operating system that can run lots of existing prod workloads. There is a reason why Linux is over 30 years ol
90.
Cutting Alloc Time Down with Transparent Pages in the Nanos Unikernel(nanovms.com)
2 points by eyberg 2y ago|0 comments

More ›