[Discuss] microkernels

[bctill]

On 2023-04-07 12:40, BCLUG wrote:
> (Apologies if this is a duplicate - my Thunderbird seems to be using an 
> incorrect sender to this mailing list.)
> 
I only see one copy of it.  I do see a second email from you, but with 
different content.  For the sake of conveniencem, I'll reply to both of 
them here.
> 
> bctill wrote on 2023-04-06 14:42:
> 
>> But I can think of no reason why people don't use mircokernel-based 
>> operating systems for small-scale, mission-critical applications, for 
>> which reliability and security are crucial.
> 
> Because mission-critical, high-reliability, highly secure kernels 
> require a large pool of highly skilled developers and those devs stick 
> with what a) works, b) they already use.
> 
> See "network effect".
> 
Yes, I suspect that has a lot to do with it.
> 
>> Why does no one run servers on QNX, for example?
>> 
>> How about Debian GNU Hurd?  Can you run a server on that?
> 
> They probably lack device drivers, user-space tools, and devs & admins 
> that know how to use them.
> 
> 
> People just want to get the job done that they're paid to do.  And if 
> new requirements come along, and the tiny, boutique tools they've 
> chosen don't support that, they don't want to have to add features to 
> the kernels / OS themselves.
> 
Again, you're right.  I'm interested in what force relegated 
microkernels to the status of "boutique tools", kept them there for 30 
years, and continues to keep them there to this day.
> 
>> The Mach and L4 microkernels are out there, but the projects that 
>> coalesce around them keep dying.  Why?
> 
> They don't solve any problems any better than what currently exists.
> 
They would if the force I mentioned above hadn't prevented serious 
development for the last 30 years.
> 
>> Microkernel architechture seems like the obviously optimal platform 
>> that FOSS should move toward.
> 
> Yet FOSS hasn't moved that way.  Maybe it's not obviously optimal after 
> all.
> 
> I believe Linus Torvalds was asked about this in the past and he stated 
> his reasons (which I do not recall, but I believe it was performance 
> related).
> 
Aha.  I think we're getting warm.  The Tannenbaum / Torvalds debate of 
the early 1990's has a lot to do with it.  Torvalds was right at the 
time, but for reasons that no longer apply.

Microkernels were not ready for prime time in the early 1990s, mainly 
because Dan Dodge had assigned his patents on high-performace message 
passing to Quantum Software Systems.  Anyone who distributed a 
microkernel with acceptable performance back then would therefore have 
had to pay royalties, and that's not FOSS.

But that was then and this is now.  The QNX patents have expired.  So 
the factors that made Torvalds' theoretically wrong approach 
pragmatically preferrable 30 years ago no longer matter.
> 
>> Why is there so little interest?
> 
> Google chose Linux as the Android kernel, and they have access to the 
> best engineers / devs.
> 
> They came up with Fuchsia as a replacement, and quietly released it on 
> approximately 1 device.  I don't know if it's a micro-kernel 
> architecture.
> 
Good point.  Another example of the damage done when too much power is 
concentrated in too few hands.  I thought the whole point of the FOSS 
movement was to militate against that concentration of power, yet it 
seems that the only FOSS projects that succeed are the ones that have 
the blessing of the exact same organizations FOSS is purported to stand 
against...
> 
> Gnu Hurd has got at least one good dev, and a couple decades worth of 
> development time, and it's used by approximately zero serious users.
> 
Who is that developer?  Is Hurd development still alive?

I can't figure out if GNU and Debian have one Hurd project going or two. 
  And I haven't been able to find any Hurd activity at all since 2021.
> 
> Having suffered through being an OS/2 fan, I can confirm that having 
> superior tech that isn't properly supported and has little to no 
> software available is an unpleasant experience and just not really 
> worth it most of the time.
> 
Indeed, OS/2 was much cleaner than DOS 3.2.  But from my point of view 
at the time, choosing between IBM and Microsoft was like choosing 
between Scylla and Charybdis.  I picked Microsoft, and that paid off for 
a while, but NT 5.0 was the high point.  Everything after that just got 
more and more invasive.
> 
> Just enjoy the fact that we have access to the most popular and capable 
> computing tech ever in history (for free) and don't worry about the 
> fact it has some features you don't want.
> 
> Obligatory car analogy!
> 
> "I could get 0.01583 better mpg if I remove the 3rd row seating, the 
> passenger seats, power window motors, audio system, etc.
> 
> It'll take me a week, some custom fabrication, access to a machine 
> shop, and a hired mechanic for a day or two, but ... 0.01583 better 
> mpg!"
> 
Telemetry I can't turn off and system modifications I can't refuse go 
way beyond "features I don't want".  They result in complete destruction 
of privacy and autonomy.  And those are not things you merely want.  
Those are things you need.

That's why your "better mpg" analogy couldn't be farther off base.

The real analogy is: "for your own safety, remain in your cell."
> 
> My 2¢.
> 
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://vlug.org/mailman/listinfo/discuss_vlug.org

Hi Ron --

On a single portable device, like a smart phone or a laptop, Qubes looks 
like a good approach, if the device has enough processing power.  But 
for a fixed installation there is no reason to incur the increased 
attack surface that a hypervisor brings.

Computing hardware is so cheap nowadays that you're better off to devote 
a dedicated machine to each mission-critical task.  So firewall, web 
server, and email stack would each run on its own dedicated machine, all 
behind a SonicWall "security appliance".  End-user workstations, 
printers, and so on would be on another subnet, also behind the 
SonicWall.

SonicWall makes great products, but they're not built to interdict data 
mining, telemetry, or automatic updates.  For that, you need 
application-aware deep packet inspection.  SonicWall says they have 
that, but when they say "application", they mean stateful rules for 
HTTP, FTP, POP3, and so forth.  When I say "application", I mean actual 
end-user applicaton programs, like Office Suites, Drawing Tools, Web 
Browsers, and so on.

So that's why I'm considering putting a custom firewall between the 
local subnets and the SonicWall.  The SonicWall can enforce all the 
rules that are within its capabilities (which are quite extensive), and 
the custom firewall can inspect the actual data payloads of packets and 
prevent specific programs, running on specific machines, from performing 
specific actions.

I would like to be able to enforce rules like "you can validate your 
license, but you can't send bug reports containing proprietary data" or 
"you can surf to any web site you like, but you can't send it any data 
it can use to track you".

If I have to write some code to accomplish that, it's okay.  I'm not at 
all sure this is even possible to the extent that I envision, but I 
would like to get as close as I can without spending the rest of my life 
implementing it.  Hopefully, I will get it figured out before people 
tire of my questions.

As for Whonix... as far as I can tell, it's just a Tor-enabled version 
of Firefox.  Only the end-user workstations will be running a browser.  
There will only be a few of these, and I want to give the people running 
them as much freedom as possible while sandboxing certain behaviours of 
the sofware they install.

For the tasks I called mission-critical above, I want to configure 
bare-bones builds with everything stripped out that isn't essential to 
perform the task.  So, say I'm using Postfix as a mail transfer agent 
and Dovecot is a mail delivery agent.  Then the operating system on that 
machine has the packages that Postfix or Dovecot depend on, the 
necessary sysop utilities, and nothing else.

Actually, if I could license QNX for those machines, I might not feel 
the need to compile anything.  See here:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=QNX
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Debian

MITRE Corporation reports 52 vulnerabilities for QNX, compared to 11,051 
for Debian.  But the installed base goes very much the opposite 
direction: 215 million for QNX, compared to 33 million for all Linux 
distros combined.

QNX is 100% POSIX compliant.  Is that enough to allow Apache or Nginx to 
run on it?

By the way, I would like to add that I very much appreaciate this 
conversation, Ron.  It's really helping my thinking evolve from vague 
desiderata to concrete options.

Regards,
-- Bernie.