dmcq (dmcq.delete@this.fano.co.uk) on January 17, 2021 5:39 am wrote:
> Jukka Larja (roskakori2006.delete@this.gmail.com) on January 16, 2021 8:37 pm wrote:
> > dmcq (dmcq.delete@this.fano.co.uk) on January 16, 2021 1:50 am wrote:
> > > Jukka Larja (roskakori2006.delete@this.gmail.com) on January 15, 2021 8:04 pm wrote:
> > > > dmcq (dmcq.delete@this.fano.co.uk) on January 15, 2021 1:58 pm wrote:
> > > > > Anne O. Nymous (not.delete@this.real.address) on January 15, 2021 11:19 am wrote:
> > > > > > dmcq (dmcq.delete@this.fano.co.uk) on January 15, 2021 7:27 am wrote:
> > > > > > > Jukka Larja (roskakori2006.delete@this.gmail.com) on January 15, 2021 5:57 am wrote:
> > > > > > > > dmcq (dmcq.delete@this.fano.co.uk) on January 14, 2021 11:13 am wrote:
> > > > > > > > > Jörn Engel (joern.delete@this.purestorage.com) on January 14, 2021 10:42 am wrote:
> > > > > > > > > > dmcq (dmcq.delete@this.fano.co.uk) on January 14, 2021 7:26 am wrote:
> > > > > > > > > > >
> > > > > > > > > > > I'm basically in agreement with Maynard about this. I've never had anywhere near as many customers as
> > > > > > > > > > > Apple :-) but even so a major consideration for me has always been the support costs.
> > > > > > > > > >
> > > > > > > > > > You are considering a different question. Your question is "Why would Apple
> > > > > > > > > > want to...". My question is "Why would I (or some other user) want to...".
> > > > > > > > > >
> > > > > > > > > > Of course Apple doesn't care whether I, Linus or the other twelve people buy an extra machine
> > > > > > > > > > to run Linux on it. Doesn't invalidate our reasons to prefer bare metal over hypervisors.
> > > > > > > > >
> > > > > > > > > Eveyone who writes software has support costs unless it is just a private hobby tinkering
> > > > > > > > > around with their own machine.This thread is about gaining perhaps 3% performance if things
> > > > > > > > > work out okay and incurring the trouble of writing ones own drivers which might go out
> > > > > > > > > of date in the next iteration. And for what from the point of view of a user?
> > > > > > > >
> > > > > > > > You presume that MacOS is better OS than Linux (for whatever value of "better").
> > > > > > > >
> > > > > > > > -JLarja
> > > > > > >
> > > > > > > I presume only that a good hypervisor can be built which splits off what is needed to
> > > > > > > be done by the operating system and the firmware that is more dependent on the specific
> > > > > > > version of the hardware. And that a lot of people are interested in security.
> > > > > > >
> > > > > >
> > > > > > How does adding more between the bare metal and the OS add
> > > > > > to security? Sure a hypothetical flawless hypervisor
> > > > > > might do the trick, but how is that any more secure than an equally hypothetical flawless OS? This is not
> > > > > > an argument why apple should or should not consider this just a question about your argument ;)
> > > > > >
> > > > > >
> > > > >
> > > > > If anyone can stick in a new operating system that has full access to everything there is no security.
> > > >
> > > > Just as well anyone can stick in a new hypervisor. I don't really see what's the difference between
> > > > hypervisor and OS in this argument. Or is the point just that a limited system where user can't do stupid
> > > > things is more secure? Wouldn't an OS that only allows running a browser then be even better?
> > > >
> > > > -JLarja
> > >
> > > I wasn't advocating that Chromebook solved everyone's problems, but yes a more limited system that
> > > doesn't allow a person access to everything is more secure and there's lots of examples of that.
> >
> > Yeah, so it's not really about running under hypervisor or not. It's one way to limit a system, but
> > not particularly good. If I run Windows 2000 in VM, it will be insecure. VM may prevent malware from
> > messing with other VMs, but if my goal is running Windows 2000 (not running Windows 2000 along with
> > other OSes), it doesn't really change anything (perhaps makes "re-installing" Windows easier).
> >
> > -JLarja
>
> No that is not what I said at all. just running a secure system on top of an
> insecure system is a waste of time. And bare metal is insecure. If it is easy
> for users to get to bare metal then anyone can compromise the system easily.

If hardware is insecure, hypervisor won't help. There's nothing magical about them.

I'm not really sure what you are trying to say. If we presume that the user doesn't have full access to the computer, it doesn't make particular sense to draw the line to where virtual machine meets hardware. Running insecure OS on top of separate hypervisor isn't significantly better than running the same OS on bare metal, if the point is only running that OS. Why not limit user to non-administrative account, or a set of white-listed programs? What's so special about hypervisor?

I'm running the laptop I'm typing this with Windows 10 on top of bare metal. How would my system be more secure, if I instead ran it in VM on top of Windows 10?

If we presume that user does have full access, removing or replacing hypervisor is just as trivial as replacing the OS.

-JLarja