Comment - FBXL Lotide

Comment on Safely exposing services to the Internet

pmk@piefed.ca ⁨2⁩ ⁨days⁩ ago

Almost 20 years ago, Theo de Raadt (founder of OpenBSD) said: “you think that a worldwide collection of software engineers who can’t write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.” I would like to think that we’ve figured out the security holes since then, but… you know..

original

Sort:hotnew top

hirihit640@sh.itjust.works ⁨2⁩ ⁨days⁩ ago
Nobody believes virtualization is perfect, it’s just the best we got because:

smaller attack surface

security is the priority over adding new features (the opposite of most other development cycles)

in practice we have seen how secure it is relative to other systems like the kernel

And anyways, even a separate physical computer can be hacked. If it has networking, there could be a vulnerability in the networking stack. Just making an outbound tcp connection can be enough to be pwned.

I think the closest thing we have to an “invincible” system is seL4, but I rarely hear about amybody using them
original