Viewing profile — nicecars

Safari actually implements Site Isolation. Process-per-tab isolation was introduced in Safari 15 in 2021, and site isolation features were further enhanced in Safari 16.4.

QubesOS lacks Secure Boot implementation and has insufficient boot chain protection. Its security heavily relies on OS isolation through the Xen hypervisor, though it remains vulne…

I agree. I haven't seen any Linux OS with proper security featuring dm-verity-based Secure Boot (except for documentation in Arch explaining how to implement it). Most distribution…

Fedora Silverblue's Secure Boot is also primarily for UEFI support and not fundamentally designed to create a boot chain or detect attacks on the OS. Additionally, it has weaknesse…

While Linux systems like ChromeOS and Android could be considered sufficiently hardened, mainstream distributions generally don't prioritize security, with developers simply creati…

macOS have superior security compared to standard Linux/BSD distributions even at the software level, separate from their hardware lockdown. Are there any FOSS desktop OS with equi…

I would like to know about less well-known but interesting security presented at the Linux Security Summit or other similar events.

Sorry, I meant greater than 5.

I'm simply curious and would like to play with it if it's there :)

Are there any FOSS operating systems that are certified EAL5+ by Common Criteria? I have seen SUSE taking EAL4+ but is it EAL5 or higher?

Why would be UNIX-like? Is it meant to be a UNIX architecture?

Is full application/process separation due to virtualization or sandboxing? Or by a validated kernel hypervisor? Or something like Unikernel?

Why?

Xen

It's very helpful! Thanks! But is this a single unikernel? Or is it a management of them?

If I need to isolate containers, which is the best OS for containers when security is important: Bottle Rocket, Container Optimized OS or Flatcar and PhotonOS? And why is that? Wha…

Thank you! Now I understand that my threat model is not good! I remembered the NSA criteria, Separation Kernel Protection Profile

structure -> kernel

Is there a structure like the NT kernel(openVMS) (in FOSS) that is more stable and less vulnerable than the NT kernel?

Sorry for the uninformed question. I asked this question out of interest. The most aggressive attacker is because I recall that there used to be a criterion on Wikipedia (I don't r…

So what if it is simply used for browsing (GUI) only? I'm thinking in this case Kiosk or Chrome.

Does running Linux on SEL4 only prevent attacks on the hardware or firmware level if Linux is compromised?

I like it