Fuchsia is not Linux
Some problems I see from skimming the docs:<p>&gt; Calls which have no limitations, of which there are only a very few, for example zx_clock_get() and zx_nanosleep() may be called by any thread.<p>Having the clock be an ambient authority leaves the system open to easy timing attacks via implicit covert channels. I&#x27;m glad these kinds of timing attacks have gotten more attention with Spectre and Meltdown. Capability security folks have been pointing these out for decades.<p>&gt; Calls which create new Objects but do not take a Handle, such as zx_event_create() and zx_channel_create(). Access to these (and limitations upon them) is controlled by the Job in which the calling Process is contained.<p>I&#x27;m hesitant to endorse any system calls with ambient authority, even if it&#x27;s scoped by context like these. It&#x27;s far too easy to introduce subtle vulnerabilities. For instance, these calls seem to permit a Confused Deputy attack as long as two processes are running in the same Job.<p>Other notes on the kernel:<p>* The focus on handles overall is good though. Some capability security lessons have finally seeped into common knowledge!<p>* I&#x27;m not sure why they went with C++. You shouldn&#x27;t need dispatching or template metaprogramming in a microkernel, as code reuse is minimal since all primitives are supposed to be orthogonal to each other. That&#x27;s the whole point of a microkernel. Shapiro learned this from building the the early versions of EROS in C++, then switching to C. C also has modelling and formal analysis tools, like Frama-C.<p>* I don&#x27;t see any reification of scheduling as a handle or an object. Perhaps they haven&#x27;t gotten that far.<p>Looks like they&#x27;ll also support private namespacing ala Plan 9, which is great. I hope we can get a robust OS to replace existing antiquated systems with Google&#x27;s resources. This looks like a good start.