The question I always have when I see these userspace kernels is, Linux in Userspace exists. You can boot Linux with a root in userspace already. Why write a new kernel from scratch instead of fixing/improving usermode Linux instead, which has the benefit of providing the entire Linux API already?

▲

xscott a day ago | parent | next [-]

Option A) Everyone shares one OS (container, sandbox, kernel, firewall, whatever). It gets a lot of eyes on it to find bugs. Hacker fuzzes it with a lot of tokens offline. He finds one exploitable vulnerability and he owns everyone.

Option Z) Everyone vibe codes their own custom OS. Each implements and exposes only what they want. Hacker has to beat up on it online to find vulnerabilities. He finds one and he only owns that one machine.

There's probably some middle ground between A and Z, but monocultures are fragile. All eggs in one basket, potato famines, banana fungus, etc...

▲

GoblinSlayer a day ago | parent | next [-]

How would it work against vulnerabilities? You still put php inside, and it handles your data. When php is hacked, all your data is stolen, it doesn't matter that your OS is slightly different.

If the host's network driver is hacked, all userland is stolen too.

▲

yjftsjthsd-h a day ago | parent | next [-]

But if php is hacked and that's chained with a LPE, we'd like the attacker to get root inside a sandbox where that doesn't mean much.

▲

casualscience 21 hours ago | parent | prev | next [-]

Php vulnerability depends on the rest of your system. E.g. imagine your system has strict sandboxing for PHP.

Also this is like the worst case where the bug is in one monolithic piece of sw. Something like the alpine ssh bug is more relevant, you can plainly see not all systems are effected.

▲

xscott a day ago | parent | prev [-]

I'm not sure any software is so valuable that you should never consider replacing it. Vibe coding a PHP substitute probably takes less time and tears than cleaning up a PHP exploit.

Someone more qualified than me can speak to isolating device drivers. I do know that one of the virtues of microkernels was supposed to be that you can run drivers unprivileged.

▲

oasisaimlessly a day ago | parent | next [-]

> Vibe coding a PHP substitute probably takes less time and tears than cleaning up a PHP exploit.

Sarcasm? Definitely not true, by several orders of magnitude. Have you seen how many built-in functions PHP has?

	▲	xscott a day ago \| parent \| next [-]
		I sincerely try to avoid sarcasm. Communication is hard enough without it. Just to clarify: I didn't mean the effort to find and fix a vulnerability in PHP (although that is also difficult). I meant the effort to reformat your system, investigate what else was compromised, and recover from backups after you get hacked through an exploit in PHP. You probably don't use every last function, and you might be underestimating what became possible this year. You could have a model search for the features you use. You could have it loop until your existing code passes with the substitute. You could have it rewrite your code to use fewer features while still passing your existing tests. I'm not saying you have to do this, but I think we should question which of our old approaches are based on old constraints.
	▲	a day ago \| parent \| prev [-]
		[deleted]

▲

andai 20 hours ago | parent | prev [-]

Forget PHP, just vibe code a substitute for the ten lines of WordPress you actually need.

(Better yet, just regular code it!)

▲

joshbuddy a day ago | parent | prev | next [-]

Heterogeneity is bffs with security though. Maybe option z isn't so bad after all.

▲

xscott a day ago | parent [-]

Yes. I'm advocating for consideration of Option Z.

Option A is the best practices status quo for a lot of people. "Don't waste time and money reinventing the wheel", "Given enough eyes, all bugs are shallow", etc...

But Option Z is becoming cheap and fast, and given all the eyes, there still seem to be a lot of bugs in Option A.

Maybe it's better to tolerate a few bugs so long as it's not the same bug on everyone's computer.

Maybe you have fewer bugs if you aren't supporting 50 years of backwards compatibility.

Maybe the economics and risks change for the hacker when he can't find bugs offline.

Maybe we should appreciate people researching how to vibe code containers and kernels.

▲

UpsideDownRide a day ago | parent [-]

If we are using only a few LLMs then chances are that they will tend to make same kind if errors when building something. Take LLM prose being annoying - it is so because it is very homogeneous.

So it can very well be worst of bith worlds, worse security on actually homogeneous systems.

▲

xscott a day ago | parent [-]

If everyone prompts, "reimplement Linux", that's possible or likely.

The dude who says, "Give me a microkernel, use QNX request/receive/respond for syscalls, it only runs WASM blobs, device drivers are isolated user mode processes, it only supports HTTPS on one network interface, and the file system is readonly ExFAT" will probably get something different.

I hate low value LLM prose (slop) too, but if you ask it to write like Herman Melville, you'll get few "it's not this, it's that".

Maybe you do still get the same kinds of errors when you ask for VMS, 64 bit memory safe DOS, or a Unikernel. I dunno, but it seems like something that could be improved when it's identified.

▲

TheAmazingRace a day ago | parent [-]

>64 bit memory safe DOS

Ok, you have me intrigued. FreeDOS-64!

	▲	xscott a day ago \| parent [-]
		One COMMAND64.COM, one CONFIG64.SYS, an optional AUTOEXEC64.BAT, and the rest of the computer is yours. Maybe use forward slashes though. :-)

▲

jareklupinski a day ago | parent | prev [-]

Option L) Hacker realizes theres more to be gained from joining the builders and shows both sides how to secure their lots against people worse than them

▲

functionmouse a day ago | parent [-]

is this before or after we lay off all the builders?

	▲	jareklupinski a day ago \| parent [-]
		if all the builders are laid off, what is there left to hack? soon after that, the laid-off hackers become the next builders :) circles. revolutions. until its learned to see whats ahead, then it can be diverted to something new

▲

c0balt a day ago | parent | prev | next [-]

Not OP but security and ressource usage are often the main motivators.

For security, GVisor is probably the most widely used userspace-kernel. A userspace kernel may also boot faster and use less resources as it can offload a lot of work to the host (FS drivers etc.)

▲

qalmakka a day ago | parent [-]

Ok, but Linux UM exists - why can't it be extended and used instead? It should in theory offer better compatibility, right?

	▲	ronsor 21 hours ago \| parent [-]
		User Mode Linux does work, but it can have significant performance issues and isn't actually very portable. Yes, I've tried using it before.

▲

thinkingtoilet a day ago | parent | prev [-]

Didn't people ask the same question when Linux came out? Why go with X when Y exists?

	▲	yjftsjthsd-h a day ago \| parent [-]
		What existed when Linux was started? It had an obvious advantage over proprietary unixen (being gratis and libre, plus running on commodity hardware), and to the best of my knowledge the only real competition was from BSD, which was at the time under some legal dispute.