Comparing Fuchsia components and Linux containers [video] • Hacker News Board

Re: Comparing Fuchsia components and Linux containers [video]

#81

Post by supriyo-biswas » Tue, Mar 04, 2025, 4:21 AM UTC

ggm wrote: post #74

est31 wrote: post #67

Earlier quoted context omitted.

ios is capabilities based, no? Edit, to explain: in ios, everything revolves around mach ports, which are capabilities. https://docs.darlinghq.org/internals/macos-specifics/mach-po...

Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions. At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach…

I'd have to disagree -- the lack of OS-level sandboxing primitives such as seccomp-bpf and SELinux[1] means that exploits happen rather regularly in iOS rather often ([2], among others).

[1] https://source.android.com/docs/security/app-sandbox#protect...

[2] https://www.csoonline.com/article/3811322/iphone-users-targe...

Re: Comparing Fuchsia components and Linux containers [video]

#82

Post by mmooss » Tue, Mar 04, 2025, 4:24 AM UTC

wqaatwt wrote: post #30

mmooss wrote: post #24

Earlier quoted context omitted.

> The answer is not much time. That would be surprising. Where do you get that? I don't mean toy OSes or experiments. Linux, MacOS and Windows are still in development and I can't imagine the number of hours invested. > they use existing libraries and the like Where can I find out about that? Thanks.

IIRC it didn't take that long to develop first production versions of macOS? A couple of years maybe? It's not like Fuschia was supposed to be a "fully capable OS developed from scratch", either? I mean it's "just" the kernel and other low level components, most of the software stack would remain same as Android/Linux at least for the time being.

> IIRC it didn't take that long to develop first production versions of macOS?

If you mean the early 1980s OS, that is not comparable. It probably ran in something like 512K of memory off of a 5.25" floppy disk (or a tape?).

> It's not like Fuschia was supposed to be a "fully capable OS developed from scratch", either? I mean it's "just" the kernel and other low level components

I don't know the answer, but doesn't the second sentence describe Linux?

Re: Comparing Fuchsia components and Linux containers [video]

#83

Post by dd_xplore » Tue, Mar 04, 2025, 4:25 AM UTC

ggm wrote: post #74

est31 wrote: post #67

Earlier quoted context omitted.

ios is capabilities based, no? Edit, to explain: in ios, everything revolves around mach ports, which are capabilities. https://docs.darlinghq.org/internals/macos-specifics/mach-po...

Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions. At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach…

It maybe robust, but it's very very limited in capability. There's no depth to GUI interactions.

Re: Comparing Fuchsia components and Linux containers [video]

#84

Post by surajrmal » Tue, Mar 04, 2025, 4:30 AM UTC

nicce wrote: post #14

__MatrixMan__ wrote: post #7

Earlier quoted context omitted.

It seems like Fuchsia components have less that they can assume about their environment and require the caller to be more explicit about what the component can do ("capabilities"). So for instance a docker container might just decide--without the user's say-so--that it wants to write a debug log file to /foo/bar/baz and then it would be up to the user to go find that file if they care. By contrast a Fuchsia component…

Sounds like it has just AppArmor/Seccomp/SELinux policies built in. You usually reach the same with previous.

The difference is that those solutions are mandatory access control. Fuchsia doesn't have a global namespace that everyone shares. Each component gets it's own view of the world based on what is passed to it. This is often easier to work with then MAC. It's similar to writing a program without relying on globals for state, but instead passing everything into every function that it needs.

Re: Comparing Fuchsia components and Linux containers [video]

#85

Post by nullpoint420 » Tue, Mar 04, 2025, 4:37 AM UTC

supriyo-biswas wrote: post #81

ggm wrote: post #74

Earlier quoted context omitted.

Yes. And without over stating it, iOS is an amazingly robust, very secure OS. it has high trust and low trust models, a secure zone, special purpose hardware and an operating system designed around minimum access rights models which manages to keep going, despite app authors worst intentions. At one level, it proves the model. The shame is that Mach otherwise has kind of not taken off. Gnu the OS was going to be Mach…

I'd have to disagree -- the lack of OS-level sandboxing primitives such as seccomp-bpf and SELinux[1] means that exploits happen rather regularly in iOS rather often ([2], among others). [1] https://source.android.com/docs/security/app-sandbox#protect... [2] https://www.csoonline.com/article/3811322/iphone-users-targe...

Does the Apple Sandbox[1] not count? What about TrustedBSD[2] and the MAC (Mandatory Access Control) subsystem introduced as part of SEDarwin[3]?

[1] https://www.ise.io/wp-content/uploads/2017/07/apple-sandbox....

[2] http://www.trustedbsd.org/mac.html

[3] http://www.trustedbsd.org/sedarwin.html

Re: Comparing Fuchsia components and Linux containers [video]

#86

Post by surajrmal » Tue, Mar 04, 2025, 4:38 AM UTC

vlovich123 wrote: post #77

surajrmal wrote: post #20

Earlier quoted context omitted.

Most components don't need to talk to the network though and therefore do not. The ones that do can do powerful things but creating narrower capabilities to restrict what they can do is very much feasible.

I’m not against capabilities. I’m just highlighting it’s for the developers to implement protections against malicious intrusions against the OS, not for users to protect against developers doing malicious things.

While there is no direct UX exposing this to an end user, it hypothetically be used as the basis of such UI. The parent of a component gets to ultimately decide what capabilities it routes to a child component. It's not like landlock where the process decides to sandbox itself after it's already running. Similar to a user constructing a VM to run a hypothetically malicious program, the same could be done much more lightweight with a fuchsia component.

Re: Comparing Fuchsia components and Linux containers [video]

#87

Post by onjectic » Tue, Mar 04, 2025, 4:40 AM UTC

dekhn wrote: post #26

bestorworse wrote: post #15

Earlier quoted context omitted.

The joy of having a properly implemented capability system is that, well, you can create arbitrary capabilities. You don't need to give a process/component the “unrestricted network access capability” -- you could give it a capability to eg “have https access to this (sub)domain only” where the process wouldn't be able to change stuff like SSL certificates. EDIT: and to be clear, fuchsia implements capabilities very…

In my experience lots of folks simply won't work with capability systems no matter how good the implementation is or whatever level of security and configuration granularity is provided. For many people it's just extra friction in search of a use case.

I am curious what your experience is with capability based security? They are still incredibly niche(unfortunately) so I’ve never had a chance to work with one at a job.

Re: Comparing Fuchsia components and Linux containers [video]

#88

Post by surajrmal » Tue, Mar 04, 2025, 4:47 AM UTC

bee_rider wrote: post #68

jeffbee wrote: post #37

Earlier quoted context omitted.

There were 25 changes updated on the Fuchsia Gerrit in the last 15 minutes. It is much less dead than 99% of open source software projects.

Are those 15 minutes representative? That seems pretty high if so.

During California working hours it might actually be a bit low honestly as you would see several revisions uploaded for code review per commit and there are on average 200-250 commits submitted daily to the primary fuchsia repo.

Re: Comparing Fuchsia components and Linux containers [video]

#89

Post by vlovich123 » Tue, Mar 04, 2025, 4:48 AM UTC

surajrmal wrote: post #86

vlovich123 wrote: post #77

Earlier quoted context omitted.

I’m not against capabilities. I’m just highlighting it’s for the developers to implement protections against malicious intrusions against the OS, not for users to protect against developers doing malicious things.

While there is no direct UX exposing this to an end user, it hypothetically be used as the basis of such UI. The parent of a component gets to ultimately decide what capabilities it routes to a child component. It's not like landlock where the process decides to sandbox itself after it's already running. Similar to a user constructing a VM to run a hypothetically malicious program, the same could be done much more li…

All I said is that in the general case you’re not going to be able to rely on capabilities to do things like prevent phoning home or otherwise doing things you semantically define as harmful. This isn’t a UX issue - this is a technical issue. Capabilities, outside from very rare circumstances, can’t enforce it no matter how you structure this. The only rare circumstances is if you can restrict access to servers that aren’t owned by the same people as wrote the component. As soon as you give access that allows access, they can implement it in ways that capabilities can’t prevent.

Re: Comparing Fuchsia components and Linux containers [video]

#90

Post by surajrmal » Tue, Mar 04, 2025, 4:49 AM UTC

michaelmrose wrote: post #51

jeffbee wrote: post #37

Earlier quoted context omitted.

There were 25 changes updated on the Fuchsia Gerrit in the last 15 minutes. It is much less dead than 99% of open source software projects.

The two biggest factors are how committed to this is Google and who is interested in developing and using this if Google drops it. What do you think the answers to those are?

Factors for what? Deciding whether it's in life support? Deciding if it's okay for you to depend on it?