Hacker News new | past | comments | ask | show | jobs | submit login

>the concept of users and user groups have failed

Hopefully we won't go back to the Win95/98 era of everything running as single user!

Having services run isolated as their own users is not merely a good security mechanics, it provides for a clear and simple mental model of what is what. A clear permissions barrier that's enforced pretty strictly by the OS.

Moreover we see separate user accounts more and more; even on small devices like phones it makes sense to have, for example, separate "private" and "business" accounts.

>does that mean processes have failed?

Nah, that's too general of a take. There are two more specific failures. First up, people fail to realize the present-day crop of containers are re-inventing processes. "Those who do not learn history, etc, etc."

Secondly, there's a significant failure of certain key features (like IP stack, FS handlers, etc. - in general, NAMESPACES) having been provided almost exclusively in kernel, and thusly requiring either superuser access or complex work-arounds (like FUSE) to manage. Plan 9 did it the right way; on P9, processes == containers.




> [...] services run isolated as their own users [...] provides for a clear and simple mental model [...]

How is that a clear and simple model? Are email or printing users?

I think the whole discussion is futile without having a common understanding of what we are talking about. That is:

- What is a user?

- What is a group?

- What is a role?

- What is an account?

- What is a service?

- What is a job?

- What is a process?

- What is a container?

- What is a namespace?

Moreover, you cannot say whether an abstraction is good or bad without knowing what our goals, use cases or target users are.


But having separate private and personal accounts on your phone is very different from application resource namespacing. They're essentially orthogonal concerns.

In the case you're making, a user (a real actual human user) has different settings when _using_ the phone in two contexts. In the latter case, applications are restricted to sandboxes with well-defined interactions between each other's memory, processes, devices, sockets, and files.


So, you run three different Gmail accounts in chrome, and two different office 365 logins in Firefox. Not only can the firefox process, under you user ID, read/write chrome's cache, local data etc and vice versa, but so can your calculator app, your cpu temperature widget and your solitaire game.

Lxc can improve a bit on this, as can "containers" (lxc or otherwise restricted processes).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: