Counting down to the next Linux LPE 0day or KVM vulnerability that agents will use to trivially escape their "sandbox".
Might need a re-think about whether if Linux is still fit for purpose on sandboxing in the first place given its memory model is riddled with C-style security issues.
It's got nothing to do with the licensing, but it used to be 'with enough eyes all bugs are shallow' for code developed in the open.
Now, open code allows anyone with tokens to burn to analyze it for hidden weaknesses. That makes publishing code a risky move unless you've already invested a lot of effort in securing it.
> 'with enough eyes all bugs are shallow'
This was always nonsense. It assumes that the eyes know what they're looking at. Most people don't know how to look at code and see attack paths.
It is actually becoming true that we have enough eyes (machine attention), though even when the bugs were shallow, normal users didn't look for them.
rvz · · focus · HN ↗
Might need a re-think about whether if Linux is still fit for purpose on sandboxing in the first place given its memory model is riddled with C-style security issues.
lukehandcool · · focus · HN ↗
jasomill · · focus · HN ↗
I’m sure there are proprietary systems with fewer memory safety vulnerabilities than Linux (and many others with more).
bzzzt · · focus · HN ↗
Now, open code allows anyone with tokens to burn to analyze it for hidden weaknesses. That makes publishing code a risky move unless you've already invested a lot of effort in securing it.
insanitybit · · focus · HN ↗
This was always nonsense. It assumes that the eyes know what they're looking at. Most people don't know how to look at code and see attack paths.
angry_octet · · focus · HN ↗
insanitybit · · focus · HN ↗