Theos is a very opinionated and not necessarily wrong position, but I feel also a bit too reductive given we are eternally having to deal with compromises of some form. Also, lest we forget, it has been two decades in the interim and oh so much has changed. In any case, this originated from their code, not virtualization, so it doesn’t really apply either way…
I think it's pretty much spot on myself and applies to more than virtualization based on the last point. It really suggests that further complexity and abstraction is not a good security posture. And I agree with this from extensive experience (embedded, defence).
Regarding the two decades since and the numerous exploitable x86-64 and hypervisor bugs suggests he wasn't wrong and that the tone was appropriate for the severity of the problem.
Sadly complexity is unavoidable for most real-world usecases. Just see how so many people interested in de-Googled phones balk at the prospect of losing access to banking apps. Telling them to go use an OS that doesn't support Bluetooth isn't going to work, but hopefully you wouldn't say that means they should give up all hope of security.
Abstraction has served us well in managing complexity before. I wouldn't abandon it out of misplaced idealism.
> You are absolutely deluded, if not stupid, if you think that a
worldwide collection of software engineers who can't write operating
systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.
This comment wouldn't survive HN scrutiny. It's a strawman argument, and doesn't address the core point at all: does virtualization improve or degrade security, when taken as a whole?
Adam's response is great, and TDR is smart, but he's been a lightning rod for 20 years for a reason: he was doing hot takes before they were even called that, and this is a great example.
Yeah, I'm with Theo on this one. Conventional OS security between Ring-0 and everything else is well understood; the problem has become too much code in Ring-0, a great fraction of which has its own interfaces across the security boundary, and the Unix security model just doesn't scale.
No capabilities, or even a sane and useful way of adding capabilities with everything in ring 0, and the flat integer namespacing of users and groups just doesn't work for what userspace needs to do today - hence namespaces, which have introduced their own problems, because (no surprise) trying to graft a tree structure onto a flat integer namespace after the fact is a mess.
Virtualization tried to sidestep all that, but to make it fast the cost has been more driver interfaces to host ring-0 - remember what the original was? - and screwing around a whole bunch with particularly arcane facets of the core ring-0 security boundary, e.g. page tables.
The bug here is not related to virtualization, but a footgun as old as C stdlib: system() that doesn't take arguments separately, and instead relies on shell escaping by the application.
I don't really know as the argument is mainly about how stupid people are... The technical argument is one paragraph ended with an insult, not much to make an educated and civilized opinion.
<< You are absolutely deluded, if not stupid, if you think that a
worldwide collection of software engineers who can't write operating
systems or applications without security holes, can then turn around
and suddenly write virtualization layers without security holes.
Allow me to start by saying that you are wrong about 'mainly about'. The argument starts with an insult, but insult is minimal and it moves directly into the technical details. But, note that how much you are wrong about the paragraph, because what you want to focus is the insult. You are so wrong about it you effectively invert the proportions of presence of technical data to insult..
Being right is not the most important part. If you're right but don't convince anyone, you've made no difference.
Theo was right that virtualization is a comparatively shoddy security boundary. At the same time, it's flexible and capable in ways that now define the shape of modern IT.
Could we have replicated that by other means? If yes, then it's on Theo and other knee-jerk critics that they never proposed a better approach and settled for insulting people. If not, then maybe virtualization was a necessary evil. Or maybe everyone else is an irredeemable idiot, but again - if we reach that conclusion, is the world better off?
They aren't, they're one of the people who latch on longstanding and neutral syntax (em-dashes, "it's not $foo") as a proof of LLM text. I don't blame them because HN has a lot of people trying to pass gen AI stuff as their own, and you need quick heuristics... but I'd encourage people at least do it right. Pay for Pangram or something.
"HN: Professionally identifying 230% of posts from 2017 as LLM generated".
That said Panagram is trash for the opposite reason. Not that some people talked like LLMs before LLMs, but now a lot of people talk like LLMs because of LLMs.
I did not claim it was most important, but he clearly called out issues that haunt us still, because we did not fix the basic initial issues ( and we are actively making it worse now with AI slop -- we because, while I use llms, I am not arrogant enough to offer my contributions to emulation, virtualization and other foundational stuff ). The point is that he called it and all of us should do some soul searching as to why his words were ignored. Because if he was ignored because 'he was mean about it', the we are kinda screwed long, because anyone with a brain that can comprehend the issue, will likely have little patience for anyone, who can't see it or won't want see to see it for some contrived semi-social reason.
But is the world a better place with that particular understanding being the norm. Would we, as a whole, be better served if function was what actually mattered? Wouldn't that be nice?
I hope when people read this though they understand this is a communication style; they're clearly trying to strongly discourage people from thinking they are suddenly protected. Effective? Maybe at one time, where "macho dev energy" was a thing. Today, not so much. You can tell they mean well because the intro sentence is actually pretty cheeky!
This is less of a virt/x86 bug and more of a "don't call system() on arbitrary user input" bug.
.. incidentally, OpenBSD also provides one of the clearest examples of how the excuse "calling system() is fine in my case, its totally not arbitrary user input" is deluded just the same, see CVE-2020-8794.
It has? News to me. Go on any major thread on this page, you’ll witness similarly strong pushback visa-vi buying into corporate backed hype, akin to the overconfidence in virt security he pointed at back then.
