| ▲ | tptacek 3 hours ago |
| One of his dumber takes. Virtualization replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" (KVM and the userland hypervisor). It's a drastic attack surface reduction, and the empirical data bears that out: kernel LPEs aren't even newsworthy (there's whole repos full of unnamed, unremarked-upon LPEs), and KVM escapes are very rare. |
|
| ▲ | boricj 3 hours ago | parent | next [-] |
| Doesn't that message date back to a time that either predates or is almost concurrent with the introduction of x86 hardware-assisted virtualization? I wasn't around playing with VMs back then, but I'm not sure that the track record of x86 virtualization 20 years ago was that great. |
| |
| ▲ | tptacek 3 hours ago | parent | next [-] | | It does, but that's an argument about implementations, and his comment is an argument about design. Just read it again and see if you think it's reasonable. Pay attention to the tone and (especially) the conclusory certainty he deploys. | | |
| ▲ | SoftTalker 3 hours ago | parent [-] | | And since then, OpenBSD has developed its own VM subsystem vmm(4), vmd(8), vmctl(8). | | |
| ▲ | tptacek 2 hours ago | parent [-] | | Sure, I mean, he was wrong, and I assume he knows he's wrong, and wouldn't say the same thing today. He's not dumb. Just this take is. | | |
| ▲ | otterley an hour ago | parent [-] | | I’ll take someone who’s dumb over someone who is smart but rudely and confidently incorrect any day. Modesty, thoughtfulness, and kindness are too-undervalued virtues in our business. | | |
| ▲ | tptacek an hour ago | parent [-] | | I agree with everybody else who's wondered why this got posted today. | | |
| ▲ | otterley an hour ago | parent [-] | | I too wonder why as it’s not news. That said, I don’t know whether Theo has since “eaten crow” or has otherwise personally evolved. |
|
|
|
|
| |
| ▲ | justsomehnguy 19 minutes ago | parent | prev [-] | | The letter is dated 2007-10. AMD released (ie commercially available) Pacifica on May 23, 2006 while Intel did released their Vanderpool a half of year earlier November 14, 2005. [0] Windows Server 2008 was RTM'ed on February 2008 which provided Hyper-V as a first class component. [1] Virtual Server 2005 R2 SP1 added support for both Intel VT (IVT) and AMD Virtualization (AMD-V) and was released 11 June 2007. [2] https://en.wikipedia.org/wiki/X86_virtualization#AMD_virtual... https://en.wikipedia.org/wiki/Windows_Server_2008 https://en.wikipedia.org/wiki/Microsoft_Virtual_Server#Versi... |
|
|
| ▲ | xattt 2 hours ago | parent | prev | next [-] |
| > replaces an ultra-functional general-purpose kernel evolved over decades to support every conceivable application with a drastically smaller "kernel" Is a Proxmox kernel that much smaller than a typical Linux kernel? |
| |
|
| ▲ | naturalmovement 2 hours ago | parent | prev | next [-] |
| If someone purposely dug up emails you wrote 19 years ago, I'm sure they'd find some of your "dumber takes" as well. I'm not sure what the purpose of revisiting this is beyond provoking a flamewar on a slow Sunday. |
| |
| ▲ | throw0101a an hour ago | parent | next [-] | | > If someone purposely dug up emails you wrote 19 years ago, I'm sure they'd find some of your "dumber takes" as well. "Give me six lines written by the hand of the most honest man, I will find something in them which will hang him." * https://en.wikipedia.org/wiki/Give_me_the_man_and_I_will_giv... | |
| ▲ | tptacek 2 hours ago | parent | prev | next [-] | | I mean, I agree there. We all have dumb takes! I hear roughly once a month about my old "I don't think Dual EC is a backdoor, it's too dumb and obvious for anyone to actually use it" take. | |
| ▲ | bawolff 2 hours ago | parent | prev [-] | | Probably people are responding less to the dumbness of the take and more the arrogance of the tone combined with the dumbness of the take. Everyone has dumb takes, not everyone is an asshole while giving their dumb takes. Regardless i do agree with you though, not sure what the point of digging up ancient skeletons is. |
|
|
| ▲ | ummonk 3 hours ago | parent | prev | next [-] |
| How big is the OpenBSD kernel and userland actually compared to a virtualization layer? |
|
| ▲ | TZubiri 3 hours ago | parent | prev [-] |
| I'm anti virtualization, but mostly due to the internal complexities of the guest applications being swept under the rug, it's undeniable that the host is protected and thus neighbouring guests (of course it is with almost 20 years of hindsight I can say this.) That the hypervisor is effectively an operating system/kernel I have always held, and that it is a smaller and thus less vulnerable kernel is an appropriate explication I think. It's very hard to secure an all purpose kernel like Linux without actually building it yourself (and even then..) |
