On Fri, Oct 18, 2019 at 8:23 AM <cho...@jtan.com> wrote: > That's not to even start on the fact that it's little more than process > switching and virtual memory on steroids, so the extra seperation on top of > what the OS already provides is little more than smoke and mirrors.
<useless-rant> My mental model of computer security often approximates putting a bank vault door on a picket fence (and maybe setting up a sniper to stop people from climbing over the door). Doesn't mean that the exercises weren't worthwhile, but in my opinion we put far too little effort into making people comprehend what's going on. </useless-rant>(Not entirely true, and raspberry pi/arduino communities for example have been putting in some useful efforts. OpenBSD is no slouch, either, but I sometimes worry about the lack of focus on physical and electronic abstraction layers.) In my opinion, good computer security typically involves multiple pieces of independent hardware (and good practices such as making and recovering backups (I've seen backup systems which never worked where that wasn't detected until they were needed because no one thought to test the backups (... then again, I've also seen multiple redundant systems taken out by a single stroke of lightning because they were in the same room... ))). Anyways, we do what we can, and no security can be perfect, but also the existence of flaws is not, in and of itself, a reason to give up. Better to classify that as "room for improvement". (Also, sad to say, but: smoke and mirrors can sometimes be useful -- if you have enough other measures in place.) Thanks, -- Raul
