Re: Capsicum for Linux?

On 01/08/14 22:04, Nigel Williams wrote:
> Via the popular news channels, Google has sponsored a port of Capsicum
> to Linux, details here:
> 

> 
> What do cap-talkers think of capsicum generally? lipstick-on-a-pig or
> butterfly from a chrysalis?

I'll go with the lipstick-on-a-pig category. Posix is not designed with
strong security.

Capsicum is a great development. However, I think it came too late. If
it was there, say 10 years ago, it would have been adopted by Debian and
Red Hat, and from there in the rest of the Linux-world.

On the server side we see lots of effort to compartmentalize each and
every service into a separate VM. Examples are: LXC, SmartOS, Docket.io,
and many more.

On the client we need something much stronger than Capsicum. We need
Polaris, Genode, Qubes-OS. IE, desktop (tablet) OSes that really use the
POLA-design. That's 20 years overdue.

We NEED to go to microkernels. Tanenbaum was right.

Although, if Google would incorporate Capsicum in Android, it would make
a big improvement on short term. Go for it.

Regards, Guido.

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/

iQIcBAEBAgAGBQJSzdFfAAoJEHPd8GglaNRmQ3QQAItO5blti2VtzgkAnaZHC0mr
wjvXGIspg+0UiS7ZsZNzyEYUqPHOt+qEFXvwBZciAR3/nvoMZNm3DFfQaNq/PV9Y
gF6eWrEbBOi2iP+2O7hQCQ4XihZ9Xg92JysDP2IPoIJY6Zg3qXaZFdmfZzjWrNO6
jmCNGWL9ko9aHBzmlEU6NtEJ1XoWsRzxmCG+rTc9AdwpAcp3hH23VU8hVfDj7P3S
GCzbZ2aDKv4JHXv2vIYOj1bnYheVm9dCjU5zisp+X5t4A51Qavv0St2asmsoMK0C
YBmuCTcnkg/wZcEilFs5nGaV7mP1kN1XiIeGwkdPSbDN3lMJms2Lc1pIA1xWgdOg
aUACMMUNxmIa4ijz19sKAYxU4RcqJwOAkMApfXiLVsSzSZgBR5bo0RO2h6aNzI98
cUbirXBLpk9H8+2XEOLPDI9rmAwsH7BIp3fO31pk1KA+Z60aMJ3lp9RN9wAT9rSo
TKZZzaucFOHhWgvNLbLtpLAXvLKOop52HZtJKs5J1gKBNXB9bfcRLzpnYePujbCQ
EorhjW99IWAsQ5zQZibWf4J/uqasPO7QszK3hXyoYrei96tw4hOOWfDuPwhlxvqb
fmZuQI41Gb/2yMSXbYe/q/O61XBw5zM6R5p+e3B51rMojCfZQUgINTldtO0iS6q+
ckBdw446X7D3WDlhk7h0
=tC0O
-----END PGP SIGNATURE-----