Unikernels are secure

Post by hderms » Wed, Jul 12, 2017, 4:53 PM UTC

corndoge wrote: post #97

floobyhoob wrote: post #95

Earlier quoted context omitted.

Because you can then build single function unikernels that do one thing very fast then disappear from RAM. The point being that docker is actually a really clunky thing that is reinventing the virtual server ecosystem within the OS which is pointless. Serverless systems are better implemented as unikernels than docker images. Unikernels make it possible to boot an entire OS in milliseconds, service an inbound web req…

What's the use case for booting an entire OS to service a request?

when the OS is just some library functions statically compiled in and the entire binary is a few megabytes that you can load directly into memory, why not?

Post by fulafel » Wed, Jul 12, 2017, 6:05 PM UTC

mato wrote: post #129

tptacek wrote: post #125

Earlier quoted context omitted.

What difference does it make if there's no fork/exec? Back in 1999 we had MOSDEF and CORE IMPACT, both of which used staged loaders to boot up a language runtime in a remote process after compromising it with a stack overflow. In a broader sense this is stuff that viruses had been doing for about 8 years prior to that. Only executing native code is no defense at all. You're not even stopping attackers from the '90s l…

> Back in 1999 we had MOSDEF and CORE IMPACT (...) I'm not familiar with these. Googling "MOSDEF attack" suggests Massive Attack songs and "CORE IMPACT" various products by Core Security, I presume you're referring to neither? :-) > Only executing native code is no defense at all. You're not even stopping attackers from the '90s like that. > ROP is only a hardship until exploit code can find a way to allocate executa…

MOSDEF: https://www.blackhat.com/presentations/bh-federal-03/bh-fed-...

Core IMPACT: http://seclists.org/pen-test/2006/May/9

Re: Unikernels are secure

Re: Unikernels are secure