| ▲ | eddythompson80 12 hours ago |
| How is this different from Xen? It's the same approach as Xen or Hyper-V where the hypervisor is its own component, then you boot into a virtualized Dom0 or Root Partition (in Xen and Hyper-V terminology respectively) that can manage the hypervisor underneath it. This is different from KVM where your hypervisor runs in your Dom0/Root Partition. |
|
| ▲ | markasoftware 12 hours ago | parent | next [-] |
| Xen had a generic guest to host vulnerability disclosed in the last few days: https://codeant.ai/security-research/xenbleed-a-grant-copy-c... |
| |
| ▲ | eddythompson80 12 hours ago | parent | next [-] | | Yeah, all security design guarantees are as good as the implementation at the end of the day. All the fancy hashing and encryption math in the world isn't gonna save you from an erroneous `"" == ""` check or an invalid reference check. I was replying to OP saying it's the same "approach" as Xen, if your preference is "approach" based. It's fair though to point to Nova's smaller code base. It's becoming an important metric for me in general (how big is the code base). It's not a bullet proof thing, but having a smaller code base is a positive sign in 2026 for me. | | |
| ▲ | markasoftware 12 hours ago | parent [-] | | Novas core seems to be formally verified which rules out a vast amount of bug categories that can happen with xen, including this one | | |
| ▲ | eddythompson80 11 hours ago | parent [-] | | Interesting, I'll have to learn more about Nova. | | |
| ▲ | lrvick 11 hours ago | parent [-] | | See Udos most recent talk at 3mdeb Boot Mastery Conference. He is an ex Intel CPU engineer and the depth of his thought into the security design had me questioning my life choices. | | |
|
|
| |
| ▲ | zobzu 3 hours ago | parent | prev | next [-] | | having worked with AWS, xen had a lot of very bad vulns over its lifetime as well. there's no magic. | |
| ▲ | ThePowerOfFuet 11 hours ago | parent | prev [-] | | Now compare to Linux, which is the point raised. Nobody said alternatives like Xen are perfect... but my oh my, some are much better in this regard. |
|
|
| ▲ | lrvick 12 hours ago | parent | prev | next [-] |
| This is a much lighter weight (~100k) alternative to Xen focused on baremetal TPM anchored remote attestation, formal verification, and trusted computing applications. Anyone considering Xen should probably also consider Nova depending on requirements. |
|
| ▲ | Melatonic 3 hours ago | parent | prev | next [-] |
| Isn't VMware also that design ? |
|
| ▲ | josh-wrale 7 hours ago | parent | prev [-] |
| Xen is formally verified? |
| |
