Live data from Hacker News

Microsoft open-sources LiteBox, a security-focused library OS

github.com

141–150 of 239 posts

Re: Microsoft open-sources LiteBox, a security-focused library OS

#141
post #81

Earlier quoted context omitted.

Why would you want to?

From the article, first use case: > Example use cases include: > * Running unmodified Linux programs on Windows > * ... That won't work if the unplugged Linux program assumes that mv replaces a file atomically; ntfs can't offer that.

NTFS uses atomic transactions, that's the only way it has the ability to recover after a fault.

You can read more if you wish in 'Inside the Windows NT File System' by Helen Custer, page 15.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#142
post #71

Earlier quoted context omitted.

NTFS is just fine. Stable, reliable, fast, plenty of features for a general purpose file system.

Even with Defender etc off, it is not fun. Lots of small file IO brings it on its knees. Some wants to blame the Windows I/O system, I don't know, but what I do know is that when people choose NTFS it is because they haven't an alternative. Nobody chooses it based on its quality attributes. I dare to say there is no NTFS system that is faster than an EXT4 system. If even MS internal teams rather want to avoid it, it…

NTFS on Linux should be near-par with ext4 on Linux.

Remember, I said the _file system_ was just fine. It's that extensible architecture above all file systems on NT that causes grief.

The only method to 'turn off' Defender is to use DevDrive, which enforces ReFS, and even then you only get async Defender, it's not possible to completely disable.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#143
post #135

Earlier quoted context omitted.

The response appears to be pointing out that with so many employees (engineers), it's unlikely that they all work on Windows.

And yet they still work for a company that has shown it isn’t overly concerned about quality or reliability in its products.

Thaaat's capitalism

Re: Microsoft open-sources LiteBox, a security-focused library OS

#144

With how buggy their flagship OS has become, why would I trust anything else they release to be better? Or even if it does work well now, why should I expect it to stay that way? Microsoft has burned through all possible goodwill at this point, at least for me.

Microsoft US a massive corporation with so many people, business units, departments. A comment like yours is just like saying: "I know a buggy open-source software, why would I trust that other open-source project? The open-source community burned all possible goodwill".

Except that a company, no matter how heterogenous, has an overarching organization, whereas the open-source community doesn't.

There is no CEO of open source, there are no open-source shareholders, there are no open-source quarterly earnings reports, there are no open-source P&G policies (with or without stack ranking), and so on.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#145
post #136

Earlier quoted context omitted.

>Windows 11 is running on my ThinkPad T530. Its CPU is very nearly 14 years old. Yes, you can bypass HW checks to install it on a pentium 4 if you want, nothing new here. >What is missing here that was present when this same computer was running Windows 10? All the security features I listed in the comment above.

So, if I'm hearing this right: This computer had the security features that you listed while it was running Windows 10, and now that it is running Windows 11 it is lacking them? (I'm not trying to be snarky. That's simply an astonishing concept to me.)

It hadn’t. Windows 11 has them, due to support for new hardware mitigation features. What is it you don’t understand in particular?

Re: Microsoft open-sources LiteBox, a security-focused library OS

#146
post #145
post #136

Earlier quoted context omitted.

So, if I'm hearing this right: This computer had the security features that you listed while it was running Windows 10, and now that it is running Windows 11 it is lacking them? (I'm not trying to be snarky. That's simply an astonishing concept to me.)

It hadn’t. Windows 11 has them, due to support for new hardware mitigation features. What is it you don’t understand in particular?

There's a lot here that is hard to understand:

> > What is missing here that was present when this same computer was running Windows 10?

> All the security features I listed in the comment above.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#147
post #27

The lack of integrated sandboxing in windows compared to android/iphone is still frankly unacceptable. I've become increasingly paranoid about running any application on Windows (not that your average linux distro is even remotely better) and yet Apple and Google seem to be far, far ahead in user permissions (especially with GrapheneOS, god bless that team) and isolation of processes. Consumers and businesses deserve…

> I've become increasingly paranoid about running any application on Windows (not that your average linux distro is even remotely better) Linux excels over Windows in the area of security by a wide margin, I have no qualms about running an app on Linux versus Windows, any day of the week.

And executable you run has access to any file in your home directory, including SSH private keys, secrets in config files, browser cookies, passkeys—all of it. That includes the thousands of npm modules installed as a transient dependency of at least one tool you use that brings node as a dependency.

Windows at least has a proper ACL system; on Linux it just takes a single compromised executable to loose everything.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#148
post #82

Earlier quoted context omitted.

The file system isn't slow. The slowness will be present in any file system due to the file system filters that all file system calls pass though.

Right, by “file system” here I mean all of the layers between the application talking in terms of named files and whatever first starts talking in terms of block addresses. Also, as far as my (very limited) understanding goes, there are more architectural performance problems than just filters (and, to me, filters don’t necessarily sound like performance bankruptcy, provided the filter in question isn’t mandatory, un…

NTFS will perform directory B+-tree lookups (this is where it walks the path) until it finds the requested file. The Cache Manager caches these B+-trees.

From there, it hits the MFT, finds the specific record for the file, loads the MFT record, and ultimately returns the FILE_OBJECT to the I/O Manager and it bubbles up the chain back to (presumably) Win32. The MFT is just a linear array of records, which include file and directories (directory records are just a record with directory = true, essentially).

Obviously simplified. Windows Internals will be your friend, if you want to know more.

Re: Microsoft open-sources LiteBox, a security-focused library OS

#149

Earlier quoted context omitted.

The criticism was directed at the company's product, not the employees...

The response appears to be pointing out that with so many employees (engineers), it's unlikely that they all work on Windows.

Maybe. But interpreting it thus requires too much charitableness for it not to have been uncharitable, whether intentionally or otherwise.
Post reply on HN