alt Hacker NewsI'm a firm believer that hardware virtualization is the way forward for security. Qubes OS has the right idea, but running an entire OS for every application is demanding.
IMO it would make more sense to run every app in its own scaled down VM, like Microdroid for Android. Windows 10 had Microsoft Defender Application Guard for Microsoft Edge, and as far as security goes it was a fortress.
Too bad they discontinued it, and that performance was subpar. I would have loved to see them develop the idea more.
Replies
Aren’t you then just moving the responsibility from OS (process isolation) to the CPU ? And doesn’t this whole thing break with practical realities, such as processes needing to interact with each other ?
How would you deal with a password manager or a clipboard in these cases, for example, without increasing friction for users ?
Processes are already hardware paravirtualization, and some early implementations even called them VMs. However, https://xkcd.com/2044/ is inescapable.
Sandbox or virtualize everything does not eliminate the need to share data. Something control that permission, and it is the weakest link.
Either you end up with something don't work, too lax, or just DoS the user with permission dialog.
I work on making this a reality with an embeddable VM.
Performance doesn't have to be supbar, infact with the right properties and focus on being lightweight - I see 90% of native performance.
I work on this as context: https://github.com/smol-machines/smolvm