I have heard that both Intel and AMD are about to release chips with
features to make it easier than ever to virtualise them.
Perhaps what you might do then in run your firewall in a different
virtual machine, and perhaps other functions could be carved off into
their own worlds to help cut down the rising complexity of
interactions.
At the very least there needs to be a way to put device drivers off
into their own boxes so no matter how they fail they can't take the
whole system down with it. Device drivers can never be as trusted as
the core OS, yet they need very low level access. This hints some sort
of radically different design is needed, perhaps using little CPUs on
all I/O cards.
I think back to the CDC 6600 with its array of I/O of ,was it a
dozen?, I/O processors (faked by one big one). The main CPU did not
get interrupted.
Uplevelling the hardware interface would work by allowing
communication only via shared ram with the i/o processor only able to
see small windows of it that were its business. A hardware disk
controller would interface at the level of the device driver does now,
or perhaps a notch or two higher -- implementing a whole file system
in its own clever way, e.g. with marthaing, lookup of files by a
variety of keys, including content, key, marthaing, multiple heads,
background defrag, raid, toggling, backup snapshots frozen in time
without shutting down everything, checkpoints, procrastinated writes,
pre-emptive reads, sequential lookahead...
As it is now, even a keyboard utility or driver can snoop and report
its findings out the i/o ports.
There are three motives for going to much stronger hardware
compartmentalisation:
1. greater stability through isolation in air-tight compartments.
2. greater security through isolation.
3. greater speed by allowing room for more evolution and competition
within the bigger hardware responsibility box.
The irony is infinitely malleable software, because it involves so
many interaction, becomes harder and harder to change anything. To
permit more evolution you must carve off pieces of the problem that
don't have much outside interaction so they can evolve independently.
I similarly want to build air tight boxes for applications so they
can't snoop or modify files or RAM or system settings none of their
business.
It should be federal crime for a app to move all associations to
itself without permission. It simply should not be possible no matter
how malicious the app.
