@mist
be free | freedom tech | infra & backend systems
Relays (4)
- wss://relay.primal.net/ – read & write
- wss://relay.damus.io/ – read & write
- wss://nos.lol/ – read & write
- wss://relay.angor.io/ – read & write
Recent Notes
Just scrolling through oss project's PRs and every single one is a claude code review, even the casual convo feels like claude response 🫠
nostr:npub1kuzk93p4mea2yxehddet03szwx2h4uw3wqz3ehvqrwj9ssd0tetqs5adr6 This is a bad idea. Software enforced containment problems can be patched. Hardware based containment problems(and there are go...
Am I glitching or I see 3 similar replies 🫠
It’s not about assuming hardware is 100% flawless, I'm saying it’s about shrinking the attack surface( referencing the blogs )
the linux kernel has millions of lines of code with new LPE CVEs dropping constantly due to AI, like for f sake every other month.
a minimal KVM hypervisor interface is orders of magnitude smaller.
hypervisors can still be patched via host software/microcode updates. Breaching KVM is so difficult Google literally runs a $250k CTF bounty for hypervisor escapes because finding those bugs is drastically harder than finding a Linux kernel LPE.
Also, I don't think comparing a complex bit-flip attack like rowhammer to a kernel exploit is right.
No boundary is unhackable,I know that, but raising the bar significantly is the entire point.
Hope this helps, other than this, the blogs I referenced explain it more clearly.
It’s not about assuming hardware is 100% flawless, I'm saying it’s about shrinking the attack surface( referencing the blogs )
the linux kernel has millions of lines of code with new LPE CVEs dropping constantly due to AI, like for f sake every other month.
a minimal KVM hypervisor interface is orders of magnitude smaller.
hypervisors can still be patched via host software/microcode updates. Breaching KVM is so difficult Google literally runs a $250k CTF bounty for hypervisor escapes because finding those bugs is drastically harder than finding a Linux kernel LPE.
Also, I don't think comparing a complex bit-flip attack like rowhammer to a kernel exploit is right.
No boundary is unhackable,I know that, but raising the bar significantly is the entire point.
Hope this helps, other than this, the blogs I referenced explain it more clearly.
1❤️1
Containers are no longer a real security boundary ⚠️ (yes, I'm taking to you docker )
Fascinating how ai-assisted vulnerability discovery is changing the landscape I got used to with docker.
MicroVMs >> Containers ?
What even are microVMs and why ?
Let's first understand in short what containers are: 'The Illusion Of Isolation'
Containers don't run a new OS, they just use kernel namespaces (clone(), chroot) to fake it, which has it's benifits like fast startup, build, deploy etc.
Every container shares the exact same Linux kernel.
In cloud environments (like K8s or AWS ECS), a malicious app in tenant A's container can exploit a kernel bug to escape to the host, gaining access to your container's memory, secrets, and data.
Kernel zero-days like Dirty COW used to happen once every couple of years.
Now, AI-assisted research is surfacing whole new classes of local privilege escalation (LPE) bugs every few months, making patching a losing race against breakouts.
Is there a solution ??
--> MicroVMs 🔐 <--
Instead of sharing a kernel, microVMs leverage CPU hardware virtualization, to give every workload its own hardware-enforced memory address space and dedicated kernel.
Containers are great for packaging apps. But for running untrusted code, hardware-isolated microVMs are becoming mandatory.
Fascinating how ai-assisted vulnerability discovery is changing the landscape I got used to with docker.
MicroVMs >> Containers ?
What even are microVMs and why ?
Let's first understand in short what containers are: 'The Illusion Of Isolation'
Containers don't run a new OS, they just use kernel namespaces (clone(), chroot) to fake it, which has it's benifits like fast startup, build, deploy etc.
Every container shares the exact same Linux kernel.
In cloud environments (like K8s or AWS ECS), a malicious app in tenant A's container can exploit a kernel bug to escape to the host, gaining access to your container's memory, secrets, and data.
Kernel zero-days like Dirty COW used to happen once every couple of years.
Now, AI-assisted research is surfacing whole new classes of local privilege escalation (LPE) bugs every few months, making patching a losing race against breakouts.
Is there a solution ??
--> MicroVMs 🔐 <--
Instead of sharing a kernel, microVMs leverage CPU hardware virtualization, to give every workload its own hardware-enforced memory address space and dedicated kernel.
Containers are great for packaging apps. But for running untrusted code, hardware-isolated microVMs are becoming mandatory.
6
nostr:npub1kuzk93p4mea2yxehddet03szwx2h4uw3wqz3ehvqrwj9ssd0tetqs5adr6 Instant diffs with the vps sitting nearby is why I moved my own repos over.
the instant feedback is crazy compared to what github offers
❤️1
🛠️ Self Hosted --> Forgejo::16
damn, the snappiness compared to github !! the diffs open instantly, same of the files back nd forth, btw it's much more responsive if you cut the network latency (having your vps nearby), the ui's cool too, no nonsense.
damn, the snappiness compared to github !! the diffs open instantly, same of the files back nd forth, btw it's much more responsive if you cut the network latency (having your vps nearby), the ui's cool too, no nonsense.
2❤️2