Hacker News
points by mike_hearn 3 days ago | 0 comments
Why would unikernels fix this? They don't even attempt privilege separation at all.
[–] __d 2 days ago
Because 50m lines of code with whatever defect density is a lot more defects than a dedicated app+kernel with just the code that you need. So much of the Linux kernel is unused by any given application: why have that code loaded and runnable?
[–] muvlon 3 days ago
Exactly. Anybody deploying Linux today in scenarios where you might replace it with a unikernel is already not affected by LPE. They have a kernel running in a VM with one user and one application, in essence using Linux as a sort of bloated unikernel.
Hacker News