Conversation

What is your opinion of hypervisors? Couldn't they be considered the next best thing - a compromise between hardware compat and isolation? ^HU

Quote Tweet

Daniel Micay

@DanielMicay

Oct 30, 2018

Replying to @DanielMicay and @Whonix

The Linux kernel is the equivalent of running the entirety of userspace as root in PID 1. There's no isolation or internal security model. It keeps getting worse as more and more complexity is piled on, all of it implemented in C and without any isolation between components.

Replying to

I think the

approach makes a lot of sense. It's a very pragmatic way to deal with this growing problem. Every Linux kernel release is substantially more complicated than the last, with more attack surface and more ways for things to go wrong internally.

5:11 PM · Oct 30, 2018Twitter Web Client

Replying to

and

Software is written to run on Linux (desktop, server, Android) though, and a more secure OS without applications for it isn't much good. I think in the long term, the ideal would be having a robust microkernel with drivers, filesystems, etc. divided up and isolated well.

Replying to

and

It needs a way to run existing applications though. The virtualization approach is the most realistic / pragmatic right now. Ideally, I'd like to see a Linux compatibility layer able to avoid having the Linux kernel in the guest, and virtualization could also become optional.

Show replies