maybe this is software's quartz crisis. mainstream software will become cheap and disposable, but you'll be able to buy a luxury computer with artisanal handcrafted software that lasts for generations for only a few hundred thousand dollars

@joe see also, when quartz arrived, people did say "the battery is rubbish" and "you have to get it replaced every month" and "you won't hand it down to your children" and all that remains of the industry is luxury consumerism wheee

@tef hardware-wise, the industry's already been at the point where any laptop or phone from 15 years ago would be physically fine, if not for abandoned software support and soldered-on consumables like battery and ssd. maybe sloppening will cause hardware quality to peak but i would hope that better repairability regulations help with the latter problem. software strikes me as the weak link in us getting to heirloom computers (of course companies don't want to fix that so they can sell new ones)

@joe @tef we still don't have widespread deployment of CHERI or even MTE, which in light of the one hundred CVE per day should be considered a necessity, not a luxury

@whitequark @tef if i was going to sit down and spec out a forever os, i think i'd also want to make sure the components that are the biggest attack surfaces are compartmentalized from the rest of the system, so essential security updates can roll out independent of whether you update the UI parts of your system, so you don't have to take the flavor-of-the-month UI updates or A/B tests just to not get owned. (though i know there's no perfectly clean separation there too)

@joe @whitequark @tef I am very much of the opinion that CHERI and friends are only so effective on today’s poor software choices: C-like languages and monolithic OS components (especially the kernel). A forever-OS based on better choices and constructions could run fine on hardware lacking such features.

@jripley @joe @tef a Rust kernel that makes use of unsafe, or peripherals that use DMA, or JIT compilers within a browser, all benefit from CHERI despite not making the types of poor choices you're listing here

@whitequark @jripley @tef iommus have at least mostly become consistently available and turned on by default in the last few years

Follow

@joe only on big computers that are pretty inhospitable to security for other reasons

Sign in to participate in the conversation
CleverLibre Social

CleverLibre Social is an inclusive social instance for open discussion, learning, and community.
All cultures welcome.
Hate speech and harassment strictly forbidden.