seL4 microkernel

“None of this can ever affect seL4 nor a system built on it, due to its architecture.”

“And, unlike a demonstrated shitty browser sandbox, seL4 formally guarantees isolation. Capabilities cannot be forged.”

“provides machine-checked proofs for an OS kernel that no execution can reach a state that is undefined”

“The microkernel multiserver system architecture, with a formally verified microkernel.”

“It is an important and serious kernel, but a very small one and a very simple one”

“Honestly the biggest insight I take from sel4 is that we can get improvements in security by breaking up a large program into isolated pieces.”

“The SeL4 team has written extensive documentation of how they did it. They also opensourced their kernel implementation, with correctness proofs for the whole thing.”

“your network stack and whatever else can be split off into isolated processes which talk over capabilities”

“uses seL4's formally proven safety properties to meet the timing and separation requirements”

“Security is risk mitigation, and a reduced surface area makes it easier for everyone to focus on the remaining areas.”

“This is true, but outside of the scope of the kernel (which is a theme with microkernel). Side channels are unfortunately a side effect of how hardware works.”

“I'd say pretty useful and it doesn't mean they don't have counter measures for to counter their exploitation”

“the blast radius of a compromised program in SeL4 is much smaller because of the capability model”

“seL4 is still a good example of how we could go towards building systems that are truly secure by design”

“Check out seL4 and CompCert for real-world examples of complex software proven correct and used in industry.”

“I am not aware of any microkernel actually competitive with seL4, open or else.”

“seL4 + linux kernel api shims does seem like the most realistic approach to move forward”

“It goes beyond proving the code is UB-free and actually formally verifies the code works as intended.”

“Neat stuff, but this is not going to easily run the vast majority of open source software out there.”

“Fortunately, seL4 foundation is picking up momentum, with large companies joining every year.”

“A practical industrial proven correct micro kernel used by billions of devices worldwide.”

“I cannot see how this approach can be scaled to something like a personal computer.”

“When seL4 came around, it helped me rethink microkernel architecture and limitations”

“Microkernels make these sort of problems much harder to exploit because each component is small and easier to audit.”

“Systems with capability-based security, such as seL4[0], do not suffer from this category of problem.”

“seL4 has a much better track record than Sendmail by dint of not doing very much”

“Having the kernel itself effectively single threaded reduces a whole class of bugs and complexity, at a (hopefully) negligible performance cost. Its smart.”

“So, if you want, you still get to differentiate based on interesting low-level things.”

“it pretty hard to work with specially if you want any kind of dynamic system”

“ask it why SEL4 would be considered superior to Qubes from a security perspective”

“SeL4 kernel has latency guarantees based on similar proofs (at considerable cost)”

“The only system I'm aware of with practical timing guarantees and allowing virtualization is sel4”

“we need to start seriously considering using SeL4 as a base for our operating systems”

“this is why Linux is just an interim kernel for these use cases in which we still cannot use seL4”

“sel4 is a radically different strategy that is as much of a pain in the ass as it's powerful”

“My best compliment to seL4 is that it has raised the bar and simultaneously paved the way for future generations of advances.”

“seL4 has the lowest IPC overhead of any kernel and it's an order of magnitude faster than Linux”

“performance degrades due to the sheer number of cross-boundary interactions”

“the fastest OS kernel out there which also happens to be the most formally verified”

“sel4 is the example of building a safe C program if you go above and beyond in effort.”