micro-virtualization

Hi, everyone.  I just saw an announcement about the "micro 
virtualization" infrastructure from Bromium (founded by Simon Crosby, a 
XenSource founder).  It appears to be an effort to encapsulate processes 
in a lightweight way without using a vm for each process playpen.  An 
overview:

http://www.brianmadden.com/blogs/guestbloggers/archive/2012/09/20/guest-blog-from-simon-crosby-explaining-what-bromium-is-and-how-it-works.aspx

Their solution is focused on enterprise IT, especially Windows desktop, 
rather than security engineering of trust in general.  They announced 
vSentry general availability recently.  They might be using a "taint" model.

I recently saw a talk about spearfishing, and the latest solution from 
IT security consultants is complete stateful packet inspection, 
retention of everything, desktop logging, and massive datamining.  I 
became aware of this because I did a pitch for some big data consulting 
in this area, but I found the invasiveness of their solution alarming 
due to the hazards of centralized control and creation of new, highly 
valuable targets.  (The particular market is big banks.)  Avoiding those 
downsides supplies plenty of motivation to do something different.

I mostly work in the cloud server-side now and I think there is a big 
need for capability systems between hosts and between clouds. Even 
ignoring public cloud marketing hyperbole, there is a definite shift 
toward using VMs as the best practice for provisioning in private data 
centers now; the exception is now "bare-metal". Bromium is likely to 
change the landscape; they claim 43 large customers already.  I wonder 
how far they can go without a programming model/api?

Xanadu/E kool-aid still not worn off,

Paul

P.S.: To email me directly, see the contact info at MetaZeta.com or 
Baclace.net or use my firstname dot lastname at g mail since this msg is 
sent from an email account with very little spam protection.