Hacker News
points by __d 3 days ago | 0 comments
I am kinda expecting the second coming of unikernels. The reduction in both attack surface and depth seems likely to be useful.
[–] mike_hearn 3 days ago
Why would unikernels fix this? They don't even attempt privilege separation at all.
[–] __d 2 days ago
Because 50m lines of code with whatever defect density is a lot more defects than a dedicated app+kernel with just the code that you need. So much of the Linux kernel is unused by any given application: why have that code loaded and runnable?
[–] muvlon 3 days ago
Exactly. Anybody deploying Linux today in scenarios where you might replace it with a unikernel is already not affected by LPE. They have a kernel running in a VM with one user and one application, in essence using Linux as a sort of bloated unikernel.