[HN Gopher] Announcing KataOS and Sparrow
___________________________________________________________________
Announcing KataOS and Sparrow
Author : nix23
Score : 214 points
Date : 2022-10-16 09:42 UTC (13 hours ago)
(HTM) web link (opensource.googleblog.com)
(TXT) w3m dump (opensource.googleblog.com)
| THENATHE wrote:
| Can someone TLDR what this is eventually going to be or currently
| being used for?
| tannhaeuser wrote:
| > _Rust [...] eliminates entire classes of bugs, such as off-by-
| one errors [...]._
|
| How so? OBO is a logic error isn't it?
| eldenring wrote:
| Not 100% sure what they mean, but a lot of the api choices
| really try to make indexing decisions explicit.
|
| ex: Bounds::Excluded
|
| and iterators like the other commenter mentioned.
| efficax wrote:
| Rust gaurantees (except in unsafe code) that off-by-one errors
| will never lead to reading or writing from outside of safe
| memory bounds. You can still call `unwrap` on a out-of-bounds
| vector index and get a panic (panics are considered safe since
| they are memory safe), although you should not be using unwrap
| in ways that can panic in production code.
| pas wrote:
| Iterators all the way down, maybe some const generics, who
| knows? :)
| atty wrote:
| It can't stop me from accessing index 1 when I meant 0 on a 3d
| array, so I think the claim doesn't make much sense. Rust can
| stop me from accessing index N+1 though, which is useful for
| security. Of course almost every language also has support for
| bounds checked arrays either in their core or their standard
| library, and some for of array iterators, so I don't think
| that's a particularly compelling reason to choose Rust.
| cmeacham98 wrote:
| What are the bounds checked arrays in C's or C++'s standard
| library?
| haolez wrote:
| You can enable bound checking when calling the compiler. I
| don't remember the actual command line flags, though.
| cmeacham98 wrote:
| A non-standard compiler feature is not "their core or
| their standard library".
| pjmlp wrote:
| The ISO standard requires _at()_ to be checked, while it
| leaves for implementations the freedom to decide if
| _operator[]()_ is checked or not.
|
| As such, checks for _operator[]()_ are usually only
| enabled in debug builds, although Android and Red-Hat
| ship with them enabled into production.
|
| Additionally, before C++ got a standard library, the
| frameworks that were shipped alongside compilers always
| had those checks enabled by default.
| shrubble wrote:
| 'Internally, KataOS also is able to dynamically load and run
| third-party applications built outside of the CAmkES framework.'
| jumped out at me... is it just that they are testing other
| compiled apps or something else
| maximilianburke wrote:
| fakedang wrote:
| jtgans wrote:
| This is an unrelated research project, separate from Fuchsia.
| nextaccountic wrote:
| Does this uses anything from the Robigalia project?
| https://rbg.systems/
| jtgans wrote:
| Actually, yes. We ported the seL4 crate to the latest kernel
| and modified it to better fit our needs. It's part of the OSS
| release, and we're hoping we can contribute it back to that
| project once we've done some more polishing to it.
| im_down_w_otp wrote:
| Did you look at https://github.com/auxoncorp/ferros
| childintime wrote:
| Perhaps the more interesting page is:
|
| https://antmicro.com/blog/2022/08/running-rust-programs-in-s...
|
| More about Rust and the architecture. I know Renode of its RISC-V
| meetup presentations, can't say I was impressed favorably.
| KerrAvon wrote:
| tl;dr: this is a research project to produce a new, highly secure
| from the ground up, OS suitable for low-resource / IoT devices.
| Google Death Clock doesn't apply until/if it's productized.
| yopoly wrote:
| fs111 wrote:
| I doubt they had Terry in mind. Given the outrageous things he
| said later in his life, googles marketing will not want to be
| associated with that.
| indymike wrote:
| You do know that Terry was extremely mentally ill? This
| comment comes across as insensitive to him condition and to
| others that dare to participate in society with mental
| illness.
| filoleg wrote:
| With all respect for Terry and being fully aware that the
| outrageous parts of behavior were almost definitely a
| result of his mental illness - no one in their right mind
| would intentionally try to associate their product with him
| in marketing.
|
| It isn't about "how dare he participate in society" (which
| is irrelevant, as he is, sadly, not alive anymore). You
| just simply dont associate your product in public with
| someone who talks about "cia glowies in a van outside of my
| house, trying to bait me with a handgun and an underage
| child" or records a video of themselves calling a black
| person outside an N-word with hard "r" (and then gets hit
| by that person).
|
| Again, sad story for Terry, and I genuinely feel compassion
| for the man. He clearly had a brilliant mind trapped in his
| head, but his mental illness took over it entirely. To the
| point where he became literally about as marketable as the
| Unabomber, and probably even less. It isn't insensitive to
| say that his behavior (regardless of the mental illness)
| makes it impossible to attach his likeness to your product
| in a positive way.
| fs111 wrote:
| Yes, I know all about that. That does not change that a
| marketing department will want to stay far away from the
| things he said, no matter why.
| yopoly wrote:
| It wasn't that outrageous considering how ill he was. If he
| was of sound mind, then yes - but he wasn't.
| ris wrote:
| I'm trying to figure out what (if any) relation this has to Kata
| Conatiners (https://katacontainers.io/) - it can't be a
| coincidence.
| jt2190 wrote:
| Interesting link, thanks for sharing!
|
| I'm only aware of one other attempt to secure the entire stack:
| Oxide Computing (focused more on data centers I think.)
| jtgans wrote:
| Actually, it is a coincidince. Picking names is hard, and I
| actually had no idea this project existed before I named ours.
| thefourthchime wrote:
| Hell, I've worked on two different projects called FLEX from
| two different companies.
| nix23 wrote:
| Pff....i installed ~thousand different OS's who call
| themself Linux, they even had different libc's.
| gautamdivgi wrote:
| The article mentions this but there are 2 main components that
| are not Google owned. SeL4 microkernel and the antimicro
| simulator. The git repo mentions that KataOS is the system
| services on SeL4. It is possible there is significant overlap
| with katacontainers.
| ladyanita22 wrote:
| What about Fuchsia?
| timeon wrote:
| https://news.ycombinator.com/item?id=33223040
| pyed wrote:
| trasz wrote:
| fs111 wrote:
| meibo wrote:
| Someone should build an extension to filter all of the low-effort
| "haha when will this one be shut down" garbage below every single
| news post about a Google product. It's getting a little tiresome.
| panarky wrote:
| Exactly.
|
| We're all better off when smart people can build something new,
| that advances the frontier of what's possible, and release it
| to the world for free, without committing to support it
| forever.
|
| It's nauseating when lazy commenters parrot the same, worn-out
| arguments to tear down legitimate innovation.
| helpfulclippy wrote:
| Maybe Google should build it. Then you use it for a year or two
| before it gets cancelled.
| [deleted]
| sb057 wrote:
| Google shutting down products every few weeks is getting a
| little tiresome.
| thiht wrote:
| Maybe it's low effort but it's actually the first thing that
| came to my mind when reading the headline, and it's the same
| for lots of people. It's natural that this comment comes a lot
| and it represents what people here think. Google brought it on
| itself.
|
| This is a reason I'll never use a new Google product ever
| again. I'm still stuck with Gmail and Android TV for now but
| that's about it, and I'm working on that too. I slowly switch
| my accounts to a custom domain email, and plan on switching to
| Plex because they decided to start showing ads on the TV I paid
| $2000 for.
| geerlingguy wrote:
| It's the most relevant feature to speculate about for any non-
| ad-targeted product Google introduces, so I don't begrudge
| people for commenting on it.
|
| It's to the point I just ignore any Google product launch, at
| least in terms of consideration for my own use. 5-10 years is
| an incredibly short lifespan, and there's usually no off-ramp.
| The product just dies off.
| endisneigh wrote:
| [deleted]
| bitcharmer wrote:
| It's Google's own fault that anything new they launch these
| days has a meme status. I don't see anything wrong in pointing
| this out.
|
| Similarly, many people avoid watching Netflix shows until they
| survive to season 3 at least because it's not worth investing
| your time in something that's likely to get cancelled after a
| season or two.
|
| It's their own doing and mocking it is fully deserved
| Something1234 wrote:
| Maybe, just maybe more shows should be built around being a
| single season long with fewer rear end pulls. I'm so sick of
| these multiseason shows that just do nothing or don't answer
| questions.
| karmakurtisaani wrote:
| This is already totally besides the point, but I fully
| agree. If writers know the show has a limited lifespan,
| they can build an actually coherent and interesting story.
| If they have to write season 5 out of X, it's going to be
| just disappointing and more of the same old. For this
| reason I rarely watch any shows these days.
| freedomben wrote:
| I don't disagree with you, but it's the _volume_ of the
| "pointing it out" that is tiresome. I was hoping to see an
| interesting technical discussion of the new OS, but instead
| any that might exist is drowned out with an avalanche of
| dumb. It's not a verboten thing to say, but it _is_ very low
| effort and uninteresting, and when it makes up 90% of the
| comments on an otherwise pretty interesting announcement...
| nottorp wrote:
| > I was hoping to see an interesting technical discussion
| of the new OS
|
| But what would be the point?
|
| For one, as some people said, it's secure but whatever it
| does will certanily pass information through Google, and
| you can't trust them.
|
| And two, as some other people said, Google projects don't
| survive if they get less than 100 million users.
| crazygringo wrote:
| Seriously, I don't get it because startups fail all the time.
|
| Google quite explicitly has a startup mentality in trying to
| launch lots of things and see what sticks, and shut down what
| doesn't stick. A "fail fast" mentality that is very hacker-y.
|
| Apple is the polar opposite -- they do oodles of internal
| testing and iteration and feedback and don't launch something
| until they're super-super-sure they've got a hit on their
| hands. Microsoft is closer to Apple but more willing to
| experiment.
|
| So people hate on Google when they cancel products, but nobody
| hates on all the startups that simply go out of business. To
| the contrary, they say congrats on trying, hope you try again!
|
| It's a bizarre double standard that I'll never understand.
|
| Yes, Reader was cancelled, but if Google didn't have this
| "launch and see what sticks" mentality Reader never would have
| been created in the first place. Products like Gmail and Google
| News supposedly started as similar 20% products.
|
| Why is HN so supportive of startups that try and fail, but not
| when Google does it?
| Beldin wrote:
| No, it's the most important aspect for any new Google product
| announcement. It's not up to commenters to behave better, it is
| up to Google.
|
| The comments cannot be considered garbage, since they ask the
| most pertinent question: why is this announcement worth talking
| about?
|
| And yes, Google created this situation itself. And now it has
| to justify each new product's life span. Because we don't trust
| that at all. Unlike startups, Google can easily afford to run a
| product at a loss for years. Yet we trust them less than
| startups with only a few months of runway.
| remus wrote:
| > The comments cannot be considered garbage, since they ask
| the most pertinent question: why is this announcement worth
| talking about?
|
| I disagree. Google's habit of killing projects off is
| interesting/annoying/frustrating but I don't think a trove of
| shallow "I wonder when google will kill this? lol" comments
| on every google product announcement add to the discussion.
| laurentlbm wrote:
| They're a bit much, but in this case, they've clearly added
| to the discussion. It helped to show the distrust and
| skepticism around product announcements by Google. It also
| helps us question whether it's worth it for us to invest
| time, money and/or effort into a project.
| [deleted]
| jtgans wrote:
| Well, as the TL for this engineer-driven research prject, I
| have to say it's quite demotivating to read these sorts of
| comments.
|
| As an engineer, I don't get much say in what other parts of
| the company do, but unfortunately, I have to bear the brunt
| of the blowback every time it happens, in social forums like
| this one, and in B2B interactions. It's quite frustrating,
| actually.
| endlessvoid94 wrote:
| I feel ya. Have you ever seen a google project posted and
| NOT seen these comments?
| freedomben wrote:
| I totally relate. I previously worked for Red Hat and got a
| lot of hate for decisions I had absolutely nothing to do
| with and in some cases was vehemently opposed to them (but
| I had no power to change it).
|
| Overall I love the HN community and think it is the best
| one on the internet, but it still has a vocal shallow-
| minded pocket of people who:
|
| 1. Seem to forget that they're talking to a fellow human
| being rather than a username, and don't engage any of their
| manners that normally filter out unproductive rudeness
|
| 2. Feel strong emotions toward big companies and think life
| is just as simple as telling a single engineer to "fix the
| company" as though that is even remotely reasonable.
|
| 3. Don't seem to understand how big corporate systems work.
| Suggesting that a single engineer (even if they are a team
| lead) is to blame for business decisions that get made
| almost entirely _against_ what the engineers want, is
| absurd.
|
| Good for you for speaking up though. It won't make a
| difference to the people you were commenting to, but
| overall it provides the masses with a reminder that there's
| a human on the other side of this.
| carapace wrote:
| First, thank you for taking the time to engage.
|
| Second, I feel for you. This can't be fun, and it's not
| your fault.
|
| Third, although I think I'm pretty squarely in your "target
| audience", if you will (Rust & SEL4!? Yes please!), my
| first reaction was "Oh well, too bad it will be cancelled
| before it goes anywhere."
|
| Google has done this to themselves. There is a massive
| undertow against adopting anything Google makes. ( _I still
| sting from Reader, still, years later._ ) Stadia? Etc. Why
| bother?
|
| Which brings me to my fourth and final point: Y U Googler?
| What I mean is, on the one hand no one is forcing you to
| work at Google? On the other hand when (sorry) IF they
| cancel this project are you going to continue to support it
| yourself? What is your personal stake in this project?
|
| I'm willing to give you jtgans a break, but not Google.
| atty wrote:
| I work for an automotive OEM, and when a car has a serious
| recall, I don't get to say "gee it's frustrating to see the
| whole of my company get smeared for one engineering mistake
| I wasn't a part of." There's no reason for customers or the
| public to try and figure out exactly what part of the
| company failed. It's a systemic failure of the entire
| company, and it reflects negatively on all of us.
|
| Same for you. You either need to fix Google's long term
| support issues from the inside, or expect more of the same.
| fn-mote wrote:
| > It's a systemic failure of the entire company, and it
| reflects negatively on all of us.
|
| > [...] You either need to fix Google's long term support
| issues from the inside, or expect more of the same.
|
| Some of us knowingly work for organizations that, in the
| aggregate, are crap.
|
| We stay and do the best we can.
|
| If somebody put that bullcrap of fixing our entire system
| on me, I'd laugh. Pretend you did that to me -- I would
| think that you have a poor understanding of the systemic
| issues causing the problems that bother you.
|
| To me there isn't a clear line from "present" to
| "desirable future", and simplistic approaches ("antitrust
| disassemble google") to complex problems aren't actually
| going to work (all IMO).
|
| Sometimes you do the best you can, help the people you
| can help, and feel sorry for the rest... but leaving
| isn't going to make it better, it's going to make it
| worse, because your work is above average.
|
| Actually, I guess the parent knows this since the are
| still working in the automobile industry but for others -
| perhaps what's needed is just a thicker hide, and a
| willingness to say "yep, it's gonna get killed at some
| point, good thing we MADE IT OPEN SOURCE so others can
| carry it forward."
| thiht wrote:
| Don't you think it's at least equally frustrating to invest
| time in using and relying on a product that Google will
| kill whenever it feels like it?
|
| Talk to your management about it or switch company, don't
| whine about it to the users. These comments are a symptom,
| not the disease.
| warning26 wrote:
| Well then, I hope that perhaps you and similarly-minded
| engineers can channel that frustration into pressuring your
| incompetent leadership to alter their policy of mindlessly
| killing products.
| sz4kerto wrote:
| The problem is that (HN) sentiment is generally lagging
| behind reality -- usually many-many years. There are still
| tons of comments on HN that refer to the evil Micro$oft as if
| 2022 MS was the same as the 1991 MS (while it is 'just' a
| large enterprise cloud company), etc. When anti-<some
| company> comments peak on HN then the company is usually
| already very different.
|
| So if you're betting on a product / service, then relying on
| Internet sentiment is generally a bad idea.
|
| Analogy: the best time to buy a car from a specific
| manufacturer is when everyone knows that the manufacturer is
| only producing crappy cars. Because that's when they're
| likely doing everything they can to rectify their reputation.
| (And the other way around.) Examples: French cars
| manufactured around 2010 have really good quality (especially
| the PSA models), because they produced crap around 2000 so by
| 2008 everyone knew that they should not buy a Citroen. BMW's
| from 2008 have incredibly many quality issues as BMW's
| reputation peaked around that era, so they reaped the profits
| that they could (and this was all based on the all-around
| great cars from a decade earlier).
| mcphage wrote:
| > Analogy: the best time to buy a car from a specific
| manufacturer is when everyone knows that the manufacturer
| is only producing crappy cars. Because that's when they're
| likely doing everything they can to rectify their
| reputation.
|
| Maybe--or maybe they're still in the stage when they're
| producing crappy cars, and unwilling to commit to the
| serious changes that would ultimately lead to a better
| product and better reputation.
| thefourthchime wrote:
| As a car enthusiast, I have to disagree with your car
| analogy. Most carmakers deserve their reputation. While
| some Land Rovers were even more unreliable when they used
| BMW engines, and certain models were more reliable because
| they had more Ford parts, in general, all Land Rovers are
| unreliable.
|
| Has BMW ever been reliable? Yes in the 90s and before,
| since then? No. They just don't care, they're sold as lease
| vehicles to people who care about having the newest stuff
| for 3 years and then move on.
| jen20 wrote:
| Microsoft get schtick from people who know what they are
| talking about not because of their previous monopoly-
| abusing, security-insensitive ways, but because of their
| _current_ privacy-invading, data-harvesting, lowest-common-
| denominator-accepting approaches to everything. No amount
| of contributions to other projects is going to overcome
| that, nor should it, since it is possible to do some things
| well and others poorly.
|
| The (awful) analogy certainly doesn't even hold: my
| late-2009 BMW is still going strong without a hint of
| anything beyond routine maintenance, yet according to this
| screed it should be crap...
| masklinn wrote:
| That's a very topical comment what with Google announcing
| they were killing Stadia two weeks back.
| mfashby wrote:
| I'm not sure that Google is in a similar place to
| carmakers. There are maybe 3 or 4 major carmakers, and
| their primary business is cars (well, maybe vans trucks etc
| too). If they stop selling those, the business is dead.
| There is really just one Google, which has range of quite
| different products, and it seems they can afford to fail in
| a lot of markets, but they'll still survive as a company
| despite that.
|
| > So if you're betting on a product / service, then relying
| on Internet sentiment is generally a bad idea.
|
| I don't disagree with this tho.
| Invictus0 wrote:
| We're on a forum for startups. 99% of them get shutdown.
|
| This is not a product, it's a free and open source OS, a gift
| to the world. You cannot shut down open source--if it matters
| so much to you then maintain it yourself.
| zasdffaa wrote:
| It's a rare for-profit company that releases anything
| significant from pure niceness so I can't read it as a
| _gift_. It 's part of a corporate strategy; don't confuse
| it with largesse.
| amf12 wrote:
| > It's a rare for-profit company that releases anything
| significant from pure niceness so I can't read it as a
| gift.
|
| Philosophically speaking, do most people do something out
| of pure altruism? I personally don't believe so. Everyone
| has an agenda - be it to feel better, to score brownie
| points, to make people like them, etc. Why should we
| expect for-profit corps to be altruistic? We should
| remember their for-profit motives and also accept they
| can do good deed for non-altruistic reasons.
| zasdffaa wrote:
| It may be a cultural thing, I'm a brit, you're like from
| the US, but yes over here there is a culture of altruism
| to a degree that may be greater than in the US (eg. over
| here we donate blood for free). I'm talking monetary
| compensation thought. On a personal level I try to help
| because another's happiness becomes mine.
| green-eclipse wrote:
| I mostly agree with your comment. However I'll also say
| that Google, far more than any of the other tech titans,
| has a very long history of deeply supporting and
| embracing open source. It's part of the ethos, not just
| lip service.
| jtgans wrote:
| TL for KataOS here. Yes, the actual point of the
| announcement is to get the word out about the project. We
| want to make it as open as possible, and while we have
| some hurdles with getting the entire system out in a
| collaborative fashion, we're doing our darndest to do so.
| This release actually reflects the hard-won efforts of
| several engineers on the team to get this out.
| zasdffaa wrote:
| Respect to you + your engineers, I was not having a go at
| you all, and I genuinely thank you for your work. I was
| merely objecting to some commenter describing it in a way
| I felt was misleading. Keep it up!
| pluc wrote:
| Havoc wrote:
| >the seL4 CAmkES framework
|
| Naming convention could use a bit of work, but otherwise good
| news.
| freecodyx wrote:
| Is it down. Can't access the link
| destroy-2A wrote:
| Move37 wrote:
| electromech wrote:
| > For now the only target that works is "aarch64" (for a raspi3b
| machine running in simulation on qemu).
|
| Bummer! I recently purchased an STM32 development board
| specifically to try out Rust-based embedded projects like this.
| jtgans wrote:
| Yeahh, sorry! We had a short timeframe and wanted to get
| something out for something most folks had, so the Pi seemed
| like an obvious target.
|
| That being said, seL4 has a hard requirement for an MMU, so I'm
| not sure an STM32 would work (based upon my admittedly very
| quick review of their product line for a side project of mine
| -- happy to be proven wrong!)
| grodriguez100 wrote:
| STM32MP15x.
| CaptainJustin wrote:
| The IOT space is famously immature on security. Hopefully
| Google's efforts here will go some way to improving the security
| side
| hestefisk wrote:
| downvoteme1 wrote:
| jtgans wrote:
| Actually, this is an engineer-driven project in research, not
| a PM driven project. The team and I have quite a lot of
| passion for this project and are doing everything we can to
| fight that kind of thing from happening, which is why we open
| sourced it.
|
| Please bear with us.
| Ptchd wrote:
| phoe-krk wrote:
| midislack wrote:
| Terry Davis's TempleOS was called Sparrow before. Shame on
| Google.
| johndfsgdgdfg wrote:
| InCityDreams wrote:
| mutt2016 wrote:
| 29athrowaway wrote:
| Sparrow OS was the previous name for TempleOS
| jtgans wrote:
| Ahh, that's unfortunate. Naming things is hard. If I had
| realized that was onenof the projects' prior names, I probably
| wouldn't have gone with that name. TBH, I have huge respect for
| LoseTHos / SparrowOS / TempleOS's creator Terry. He
| accomplished something very unique and made it flourish in the
| hardest of situations.
| 29athrowaway wrote:
| I also have respect for him. He had divine intellect, was the
| smartest developer that ever lived and won a chess match
| against God.
|
| https://www.youtube.com/watch?v=Raej8C2yIEc
|
| I think your new OS needs realistic elephants.
| google234123 wrote:
| Wait, I thought Fuchsia was the OS google was working on.
| jug wrote:
| I think they are working on both. If it's an IOT OS this one
| might have a radically different goal.
| yjftsjthsd-h wrote:
| And Android, and the associated real-time bits that run
| underneath Android (lk? The thing that provides fastboot), and
| Chrome OS, and whatever internal Debian modifications they're
| running. Google is apparently quite capable of maintaining at
| least three or four operating systems developments at once;
| what's 2-3 more?
| green-eclipse wrote:
| Just like the other tech titans. Microsoft has multiple OSes,
| as does Apple.
| drooopy wrote:
| redleggedfrog wrote:
| anderspitman wrote:
| It's open source
| unraveller wrote:
| no doubt this date does exist, if traction is not realized by X
| shutdown. It's a sick game of praise and share hard or your
| shit dies, dev438467211.
|
| turns out google does have support minions, providing one way
| support for google (under duress).
| schelling42 wrote:
| >As the foundation for this new operating system, we chose seL4
| as the microkernel because it puts security front and center; it
| is mathematically proven secure, with guaranteed confidentiality,
| integrity, and availability.
|
| >KataOS provides a verifiably-secure platform that protects the
| user's privacy because it is logically impossible for
| applications to breach the kernel's hardware security protections
| and the system components are verifiably secure.
|
| The wording seems quite confident, maybe it could use some
| additional "at least according to its specification". This
| approach doesn't protect against hardware bugs and side-channel
| attacks.
|
| Especially when one thinks of unexpected attacks like Rowhammer,
| there is probably no way to include them in a formal systems
| model beforehand.
| Genbox wrote:
| I've always said that computer science has a PR problem.
|
| Formally verified applications is such a foreign concept to
| people that when you say "verified correct" they get skeptical
| and mistrust the whole concept.
|
| Saying something is "secure" when it has been formally verified
| will be received with a grain of salt, but it is much easier to
| say than:
|
| "we wrote a detailed specification that define the whole system
| via algebra, and then we let a theorem prover run all possible
| permutations of the specification It has now tested a billion
| edge-cases and we have reached a state where it no longer finds
| any deviation from the specification."
|
| At least it is provable better than someone saying "it is
| secure because we think it is".
| 29athrowaway wrote:
| Or just target the thing with a muon beam.
| yjftsjthsd-h wrote:
| > protects the user's privacy because it is logically
| impossible for applications to breach the kernel's hardware
| security protections and the system components are verifiably
| secure.
|
| Notice also that they're doing the traditional Google trick of
| pretending that it respects the user's privacy because it's
| secure, while ignoring the fact that most of the users privacy
| will be destroyed by things they designed the operating system
| to intentionally do in its security model.
| geofft wrote:
| It protects the user's privacy against attackers other than
| Google.
|
| To be fair, this is an entirely reasonable threat model for a
| lot of people. For instance, if you're a reporter in an
| authoritarian country, Google is almost certainly not
| colluding with the attackers who are literally trying to kill
| you, and using a Chromebook and Gmail is probably the best
| option out there. Your threat model is "Don't die," not
| "Don't be subject to surveillance capitalism."
|
| But it's also something we should collectively be pushing
| back on. The motivating example for these products is
| "intelligent ambient systems," i.e., things like Nest hubs
| and doorbells that capture audio/video all the time. These
| products probably shouldn't exist at all, and to the extent
| they do, they should process data locally and discard it as
| soon as they can.
| londons_explore wrote:
| Google sucks up a lot of data, and is in a position to do a
| lot of bad stuff with it, but historically they have never
| told my spouse about my affair, my government about my
| accounts in the caymans, or leaked my nude pictures to my
| grandma. (I don't actually have any of these!)
|
| I really don't care how much data of mine they have while
| they limit their evil they use it for to deciding if they
| should show an ad for baseball or football shirts...
|
| And I trust them not to accidentally leak it far more than
| I trust my government or any smaller/less techy company.
| petmon wrote:
| > historically they have never told my spouse about my
| affair
|
| Have we forgotten Google Buzz? Google changed GMail to
| publicly list the people you email most. In one case,
| this de-anonymized a woman's blog and enabled her abusive
| ex-husband to stalk her.
| https://fugitivus.wordpress.com/2010/02/11/fuck-you-
| google/
|
| This is IMO the most likely way that "bad stuff" will
| happen: not maliciously, but through privacy-invading
| misfeatures connected to pushing people to share more.
| webmobdev wrote:
| Lol. Selling your data to the government is one of the
| ways they make money. BigTech and BigBrother have been in
| cahoots for more than 2-3 decades now. Read
| https://en.wikipedia.org/wiki/PRISM for more info.
| GTP wrote:
| This is true now, but once they have those data you can't
| know what they will use them for in the future. Maybe
| they will keep using them in the same way as now, maybe
| not. Also don't forget the recent case of users that got
| reported to the police by Google because they took
| pictures of their children for medical reasons.
| amf12 wrote:
| > This is true now, but once they have those data you
| can't know what they will use them for in the future.
|
| You can set up auto-deletion of data every 3 months.
| arcanemachiner wrote:
| It's actually spelled '"Auto-Deletion" of data' since you
| can't prove it's been deleted.
|
| Google and other US tech companies have no right to be
| trusted after PRISM. Not to mention the US government's
| complete abdication of public oversight under the guise
| of national security, with secret courts, secret rulings,
| and national security letters compelling silence from
| these same organizations while complying with whatever
| demands they make.
| spankalee wrote:
| You realize many tech companies responded to PRISM by
| making their data centers and private fiber more secure
| against domestic state sponsored hacking, right?
| londons_explore wrote:
| Unfortunately, I believe that there were 2 possible
| outcomes in a post-PRISM world:
|
| 1) Tech companies increased their security, but it wasn't
| enough, and security services still have a feed of nearly
| all data, through a combination of
| software/hardware/algorithmic flaws.
|
| 2) Tech companies _did_ manage to mostly stem the flow of
| information into security services. However, security
| services simply sent secret letters to all the big
| players demanding an API /backdoor and requiring them not
| to talk about it.
|
| (or some mix of the two)
| joshuamorton wrote:
| My lukewarm take is that it is possible to construct your
| company/infra in such a way that functionally, any
| employee can audit that (2) is not the case, and that
| Google comes very close to doing this.
|
| If you take security and specifically insider threats
| seriously, you can't privilege or hide any subsystem, or
| it becomes a threat of its own, so the same processes
| that prevent an attacker from creating a shadow-system in
| your infrastructure _also_ prevent you from doing the
| same thing.
| water-your-self wrote:
| Until governments approach them and demand that data or
| force Google to leave.
| Mikeb85 wrote:
| Google has refused to cooperate with authoritarian
| governments and even left China over it. Unlike Apple and
| MS...
| steelframe wrote:
| Apple's "cooperation" with authoritarian governments
| tends to only go so far as it needs to in order for the
| next iPhone to come out on time and in sufficient supply.
| Otherwise Apple bends heaven and earth to engineer their
| devices to be as secure as they can make them, even
| against state authorities.
|
| That said, if you live in China, you probably don't want
| to sync your stuff to iCloud. Not because Apple doesn't
| want to protect your data, but more because you can't
| trust anything in any data centers that are physically on
| Chinese soil.
|
| But let's get real. If you're in mainland China and the
| authorities decide they need to confiscate your phone,
| you're already fscked.
| jsnell wrote:
| > Apple's "cooperation" with authoritarian governments
| tends to only go so far as it needs to in order for the
| next iPhone to come out on time and in sufficient supply
|
| That statement is kind of information-free. If China
| knows they have Apple completely over the barrel, why
| wouldn't they demand a lot?
|
| But for how they cooperate, Apple's own transparency
| report shows they give information on Apple customers to
| Chinese authorities thousands of times per year, and
| accept the vast majority of requests:
| https://www.apple.com/legal/transparency/cn.html
|
| Likewise in Russia:
| https://www.apple.com/legal/transparency/ru.html
| trasz wrote:
| >If you're in mainland China and the authorities decide
| they need to confiscate your phone, you're already
| fscked.
|
| Funny how you specifically mention China, as if it worked
| differently in USA - the country where you can get four
| years of jail time for talking back to police.
| Mikeb85 wrote:
| Digging through the link the other commentator posted,
| Apple complied with 88% of Russia's requests for
| information and 94% of China's with over 1000 requests
| from each of those nations...
|
| Versus Google which has avoided giving information to or
| censoring search results in both countries and as a
| result is mostly banned.
| kgeist wrote:
| None of Google's services are banned in Russia.
| Mikeb85 wrote:
| Not yet but Google doesn't seem to cooperate with the
| Russian government either.
|
| https://www.reuters.com/technology/google-is-
| fined-390-mln-r...
|
| Google's given up on business there but still puts their
| sites out there (as they should).
| Shugyousha wrote:
| AFAIK they have been back in China for a few years again
| though ...
| gloryjulio wrote:
| Not sure what your a talking about. Google/Fb/Twitter etc
| are all banned in China. The major surviving ones are
| Microsoft and Apple.
| Mikeb85 wrote:
| Not really... https://en.wikipedia.org/wiki/Google_China
| gloryjulio wrote:
| This. Now iOS is starting to turning to ads business.
| Apple is officially worse than Google.
| Tagbert wrote:
| Why is Apple worse? Because they have a limited ads
| business?
| gloryjulio wrote:
| Because of hypocrisy? They pretend to be not in ads
| business with your data
|
| So now everyone is doing the same thing so called value
| the 'privacy' (aka only they could collect the data for
| themselves to do personalized ads). So in the end you
| pick the one who hoard ur data and show the ads. What's
| the difference again?
| trasz wrote:
| Google, being US-based company, is legally obliged to
| provide all the data they have to three letter agencies,
| without any real oversight. They can't refuse even if
| they wanted.
| Mikeb85 wrote:
| And same goes for MS and Apple.
|
| Regardless, I care less about the US government having my
| info than, say, Russia (especially being part Ukrainian,
| having Ukrainian friends and family, etc...).
| pkulak wrote:
| But it's still better to not have to trust a giant,
| multi-national corporation at all.
| geofft wrote:
| Absolutely agree, but how do you do that in practice?
|
| Do you self-host your services on some Linux distro? How
| many FAANG employees have upload access to that distro or
| maintain its infrastructure?
|
| (Or maybe you audited everything yourself and you're 100%
| confident in your audit, somehow, and you've turned off
| automatic updates. How many FAANG employees are working
| on fuzzers to automatically find new exploitable security
| vulnerabilities and scale out those fuzzers on their
| employers' infrastructure?)
| asoberbeck wrote:
| > Google sucks up a lot of data, and is in a position to
| do a lot of bad stuff with it, but historically they have
| never told my spouse about my affair, my government about
| my accounts in the caymans, or leaked my nude pictures to
| my grandma. (I don't actually have any of these!)
|
| You've been lucky, then:
| https://www.gawker.com/5637234/gcreep-google-engineer-
| stalke...
|
| """It's unclear how widespread Barksdale's abuses were,
| but in at least four cases, Barksdale spied on minors'
| Google accounts without their consent, according to a
| source close to the incidents. In an incident this[2010]
| spring involving a 15-year-old boy who he'd befriended,
| Barksdale tapped into call logs from Google Voice,
| Google's Internet phone service, after the boy refused to
| tell him the name of his new girlfriend, according to our
| source. After accessing the kid's account to retrieve her
| name and phone number, Barksdale then taunted the boy and
| threatened to call her. [...]"""
| esprehn wrote:
| Fwiw that was 12 years ago, and a lot of the Google infra
| has changed quite a bit since then to make looking at
| user data much harder and track access more explicitly.
| londons_explore wrote:
| I really want Google to advertise this...
|
| Ie. I want them to commit to "No human who works at
| Google will ever see your email or photos without you
| knowing about it". And then splash that statement all
| over TV ads.
|
| Set up some system so every time an engineer sees user
| data, the owner of that data is sent a notification (and
| there are legit reasons for that, like investigating a
| bug a user has reported). It doesn't need to be for every
| kind of user data, just the super sensitive ones like the
| text of emails.
| joshuamorton wrote:
| While it doesn't work for consumer accounts,
| https://support.google.com/a/answer/9230474?hl=en already
| exists, and https://cloud.google.com/cloud-provider-
| access-management/ac... goes further, requiring your
| consent before access. Although it doesn't work for
| certain legally mandated things
| Mikeb85 wrote:
| This 100x. Of all the companies/entities that have had
| some sort of data of mine over the years Google feels by
| far the most trustworthy.
|
| My country's agencies (Canada) have leaked more data than
| Google, and MS can claim they're secure all they want,
| I've had accounts on MS services hacked but never Gmail
| or Google services...
| tomrod wrote:
| There is a tradeoff between hackability and single source
| of truth.
| themerone wrote:
| I chose Google's mesh routers because I have more trust in
| their security than any competitor. I would feel pretty safe
| with PFSense, but my needs are way too simple to bother with
| that.
|
| I know a lot of techies opt for prosumer, small business gear
| for their home networks, but most of those vendors have crap
| security trackrecords. Ubiquiti, seems to be the sole
| standout in this space, but I don't trust them any more than
| google to produce secure hardware.
| snotrockets wrote:
| Security is not privacy though. If I had a piece of
| information that could kill, I would trust Google with
| safeguarding it. What I don't trust them, is not to use
| information they got. Or rather, I expect them to use it
| (but safeguard it from others, because that's how they make
| money: by being the only ones allowed access to private
| information).
| swozey wrote:
| Ubiq has had horrendous security issues
| skybrian wrote:
| This is a research project. There are no users and probably
| won't be in this form. If it makes it into a real product, it
| might not even be done by Google (since they're open sourcing
| it.)
|
| So nobody is being tricked. It just too early to say what
| real products will do.
| rodgerd wrote:
| Google's fundamental definition of security and privacy is to
| expand your privacy to Google, so yes.
| whoopdedo wrote:
| Not to mention protecting the privacy of the applications and
| operating system from the users themselves.
| jtgans wrote:
| TL from the project here: yeah, I should have done more work on
| the wording -- we locked the content too fast, and I pushed a
| tad too hard at getting the post out. :P
|
| Side-channel attacks are out of scope for the security model of
| both seL4 and our KataOS project, so bear that in mind for
| sure.
| ArtWomb wrote:
| XMAS comes early as far as I'm concerned... A rust os &
| risc-v implementation is sorely needed & I expect to begin
| experimenting on private cloud frankenwulfs immediately. I
| can see why you rushed, this in my humble opinion is bigger
| than the release of the go programming lang ;)
| Zigurd wrote:
| It's either verifiably secure or it isn't, and that makes an
| enormous difference. Also, the issue of hardware bugs purports
| to be addressed by verifiably secure CPU designs.
|
| Of course that leaves the multitude of programmable peripheral
| devices. But starting with hardware and software that are
| implemented to be provably secure is a big change. It is table
| stakes for systems to be vastly harder to penetrate.
| jtgans wrote:
| Absolutely, and this is specifically why I chose to start
| with seL4 and use Rust for the userland we built. seL4 has a
| verification framework already in place, so we can use it to
| ensure our system design and implementation is good. We've
| spent this time working with the seL4 guys to find a good
| middle ground in these changes, and we're going to see about
| verifying the design as we go, but we wanted to get these
| things out sooner rather than waiting because it affords more
| chances for feedback and collaboration. My only regret is not
| being able to open the entire source tree at once yet. We'll
| get there, but this is a good start in the meantime.
|
| We do not have our changes formally verified yet, but that is
| definitely on our roadmap -- otherwise, what's the point of
| starting from this set of options? Likewise, this is why we
| chose Rust -- there are several projects already in progress
| to produce formal verification tools for Rust, so we can
| hopefully use those as additional proofs.
| Sirened wrote:
| are there any formally verified CPUs that support any of the
| constructs needed for anything more than microcontrollers?
| Like, I have not yet found a formally verified CPU which
| supports virtual memory or caching
| riedel wrote:
| I do not quite get it: seL4 is verified. Is the rest of the
| code as well? I understand that verification of Rust is just
| starting to gain traction (compared to C, Java or Ada), or did
| they make major progress here?
| zahllos wrote:
| Yes, especially 'logically impossible' when you dig into the
| details. From the blogpost:
|
| > and the kernel modifications to seL4 that can reclaim the
| memory used by the rootserver.
|
| MMMMMMMMMMMkkkkkk. So you then have to ask: were these changes
| also formally verified? There's a metric ton of kernel changes
| here: https://github.com/AmbiML/sparrow-kernel/commits/sparrow
| but I don't see a fork of https://github.com/seL4/l4v anywhere
| inside AmbiML.
|
| I mean, it does also claim to be "almost entirely written in
| Rust", which is true if you ignore almost the entire OS part of
| the OS (the kernel and the minimal seL4 runtime).
| jtgans wrote:
| TL from the project here: you're right, the changes to the
| kernel are not yet formally verified, but that's on the
| roadmap -- there's quite a lot of work that has been done
| here, and tons more to come. The vast majority of changes we
| have made have involved lots of conversations with folks on
| the seL4 mailing list including Gernot Heiser and video
| conferences to work out the best way to do what we're doing.
|
| I realize the blog post comes out pretty strongly on this
| topic, and that's my oversight -- I let my aspirations leak
| out instead of tempering them (this is not your typical PM-
| driven project) properly.
|
| Please understand that this is an engineer-driven project in
| Research with a _very_ small team where we 're doing our
| hardest to do the right thing, so please bear with us.
| SkyMarshal wrote:
| Don't sweat it, this is just a blip. I for one have wanted
| an SEL4 + Rust based OS for a long time, really cool that
| someone is finally doing it. It's clear what the aspiration
| is, just keep working toward it.
| Veserv wrote:
| Okay, then you should fix your mistake and edit the post or
| issue a new post that does not call or imply that "KataOS
| provides a verifiably-secure platform" since it does not.
| You have achieved that when any new readers of the post do
| not mistakenly believe that it is currently verifiably-
| secure.
| RunSet wrote:
| Don't trust anything from the world's largest advertising
| corporation until you hear it from a competing source they
| don't own or subsidize.
| doublepg23 wrote:
| "Beware of bugs in the above code; I have only proved it
| correct, not tried it." - Knuth.
| olliej wrote:
| I thought Fuchsia was going to be their secure OS, and I actually
| worked on it... I guess not?
|
| This is like a really dumb version of the 90s era MS competing
| teams nonsense. All I can see is it burning out a lot of really
| talented engineers.
| neuronexmachina wrote:
| Based on my skimming, I think Fuchsia is aimed more towards
| being an Android/ChromeOS replacement, while KataOS/Sparrow
| looks like it's more aimed towards low-power embedded systems
| and IoT.
| summerlight wrote:
| Those embedded devices cannot run Fuchsia due to its resource
| consumption _and_ this project is more of being a research than
| a mature product.
| sumedh wrote:
| Before reading the comments, I had a prediction that most of them
| would be about Google shutting it down in X years.
| hericium wrote:
| dang wrote:
| Please don't post unsubstantive comments to HN.
|
| You may not owe $CEO better, but you owe this community better
| if you're participating in it.
|
| https://news.ycombinator.com/newsguidelines.html
| hericium wrote:
| I'm not a SEO "writer" who produces longish texts to transmit
| a short message.
|
| From my perspective, privacy seems important to this
| community. At least some participants aren't capitalists
| focused on squeezing every cent from users.
|
| Upvotes my comment gained before you saw it tell me that not
| all users of this forum found it to be unsubstantive. But of
| course you're the judge.
| dang wrote:
| You can't judge these things by upvotes. Sensationalism,
| indignation, and flamebait routinely attract plenty of
| upvotes.
|
| https://hn.algolia.com/?dateRange=all&page=0&prefix=false&s
| o...
|
| We're just trying to avoid the dead-end discussions that
| low-quality internet comments lead to, including name-
| calling, fulmination, snark, and the other things that the
| site guidelines ask people not to do.
|
| https://news.ycombinator.com/newsguidelines.html
| rektide wrote:
| Specifying embedded ML systems specifically is an interesting
| specialization:
|
| > _Our team in Google Research has set out to solve this problem
| by building a provably secure platform that 's optimized for
| embedded devices that run_ ML _applications._
| ClassyJacket wrote:
| addajones wrote:
| Here I was thinking they re-released the Sparrow e-mail client
| they bought years ago and destroyed.
| akerr wrote:
| Same here! Surely they could release it as open source?
| Manjuuu wrote:
| Came here to say this, I still have it in the Applications
| folder even if I don't use it anymore. Too perfect.
| jtgans wrote:
| Ah, darn. Sorry -- picking names is hard.
| akerr wrote:
| If only there was some way to search for existing project
| names... To be fair, Sparrow hasn't existed for a while...
| sigh.
| michelb wrote:
| jtgans wrote:
| Ahh, if only. No, nobody got promoted for this. This was me and
| Sam working hard to get this resesrch project out as open
| source.
| rossjudson wrote:
| It's amusing/saddening that significant numbers of commenters
| assume launch == promotion at Google _today_. The vast majority
| of promotions at Google are for impact on engineering efforts
| that never reach the public 's attention.
|
| Boring, no-comment-worthy stuff like "cut CPU usage by 10% in
| the service", or "reduced out XX of support toil", or "reduced
| attack surface of YY by ZZ".
|
| "Launched product AA" is pretty rare as a promo argument.
| shapefrog wrote:
| crazygringo wrote:
| That is entirely inappropriate here on HN.
| imwillofficial wrote:
| That's just what I want, an OS from google for my embedded
| systems
| freedomben wrote:
| As a security engineer, I see this as a great development to a
| more secure future. As a user who increasingly sees the security
| of systems turned against him (as though the _user_ is a threat
| as well) I see this as another step toward a dystopia.
|
| @jtgans (or anybody else involved) if you feel comfortable
| saying, is that something that is being considered/discussed?
| Google in general (IMHO) has a good track record here with Anroid
| and Chromebooks (particularly compared to Apple, Amazon, etc). I
| love that Android phones can be user unlocked and chromebooks
| have dev mode, but I do worry whether that is just a leftover
| from an earlier age and whether those sorts of things will soon
| be a relic of the past.
___________________________________________________________________
(page generated 2022-10-16 23:01 UTC)