Live data from Hacker News

A Kernel Hacker Meets Fuchsia OS

a13xp0p0v.github.io

11–20 of 296 posts

Re: A Kernel Hacker Meets Fuchsia OS

#11
post #9

Earlier quoted context omitted.

The word you were looking for is _writeup_.

It's weird in my later 20s I started doing this, writing homophones. I at least get my then/their/effect right still.

I think this mostly happens to native English speakers for some unimaginable reason. I don't remember ever making this mistake (but do remember plenty others to make up for it), and can't imagine myself doing it. Yet it happens to native speakers all the time.

Re: A Kernel Hacker Meets Fuchsia OS

#12
post #9

Earlier quoted context omitted.

It's weird in my later 20s I started doing this, writing homophones. I at least get my then/their/effect right still.

I think this mostly happens to native English speakers for some unimaginable reason. I don't remember ever making this mistake (but do remember plenty others to make up for it), and can't imagine myself doing it. Yet it happens to native speakers all the time.

I would guess that the difference native/foreign is simply due to the way language is learned: for native speakers, it's first and mostly orally. This doesn't explain a later appearance of mistakes though…

Re: A Kernel Hacker Meets Fuchsia OS

#14

Earlier quoted context omitted.

I think this mostly happens to native English speakers for some unimaginable reason. I don't remember ever making this mistake (but do remember plenty others to make up for it), and can't imagine myself doing it. Yet it happens to native speakers all the time.

I would guess that the difference native/foreign is simply due to the way language is learned: for native speakers, it's first and mostly orally. This doesn't explain a later appearance of mistakes though…

I right a lot less now then I did as a kid, so maybe it’s about just staying sharp

Re: A Kernel Hacker Meets Fuchsia OS

#15

Earlier quoted context omitted.

I would guess that the difference native/foreign is simply due to the way language is learned: for native speakers, it's first and mostly orally. This doesn't explain a later appearance of mistakes though…

I right a lot less now then I did as a kid, so maybe it’s about just staying sharp

You rays a good point!

Re: A Kernel Hacker Meets Fuchsia OS

#18
post #8
post #2

Very nice right up on how unfinished and insecure Fuchsia is as a result of it being so unfinished.

FTA: But to simplify my first security experiment with Fuchsia, I decided to disable SMAP and SMEP in the script starting QEMU and create the fake vtable in my exploit in the userspace I don’t see them re-enabling it later, so yes, they found security problems, but they didn’t show a complete attack, either.

Also from the start they introduce a bug in the kernel (in the TimerDispatcher implementation), and this is the very bug they focus on and eventually write an exploit for.

They explain why they do so, and the article is extremely valuable as a first step and tutorial to get started in Zircon kernel hacking. They also find some actual issues, including one CVE. But I disagree the article shows how "unsecure Fuchsia is as a result of being unfinished".

Re: A Kernel Hacker Meets Fuchsia OS

#19
I think the more interesting thing here is the fact that so much code in their repository appears to be bit-rotted or half baked, despite being documented. KASLR is mentioned all over the place but doesn't work and the answer is "we know, it's there only to stop it bit-rotting". You need to patch the system to do kernel debugging because otherwise the toolchain hangs. Syscalls are documented as enforcing security rules yet the actual checks are //TODO comments (and they are still willing to assign CVEs so apparently they just forgot?!). The syzcaller tool is advertised as working with Fuschia, yet despite trying multiple different versions he can't even compile them due to API churn. Apparently downloading and executed a binary isn't even an option, despite their vision being that Fuschia is a sea of components downloaded and run from the internet.

It's hard not to feel like maybe Google has lost the ability to develop operating systems. Fuschia has been in development for years now, it has no users outside of Google yet if you flick through their docs you'll notice a whole bunch of pages talking about deprecated components, migrations, etc. When I last looked at their docs, they read like it's been around for 20 years and has millions of apps, even though that's not true. Oh yeah and of course the giant BLM banners everywhere they have/used to have. Just checked, now those banners are replaced with "Honoring Asian Pacific American Heritage Month", lol. Apparently their vision of a futuristic OS is one in which every page in the docs has some random totally US centric bit of virtue signalling in it. No wonder they somehow can't even finish a microkernel, a design that reduces performance in return for a much smaller syscall surface area.

Post reply on HN