Subgraph OS: Adversary resistant computing platform
This is a step in the right direction (in the sense that we should sandbox applications harder), but in my opinion we have to change fundamental aspects of our stack (e.g. Proprietary Firmware &lt;=&gt; Linux &lt;=&gt; GNU-System-Libs &lt;=&gt; X &lt;=&gt; GTK &lt;=&gt; Evince), to gain more security.<p>In particular I think it is harmful that all applications share the same view on the FS and have in principal the possibility to use e.g. full unixoish capabilities. My bet is that the solution is via better type systems, e.g. an application that is a desktop game could have something like<p><pre><code>  exec :: GameConfig -&gt; WindowControl ()
</code></pre>
where GameConfig is e.g. some CFG specific to the game and WindowControl is similar to IO () however limited to interacting with a drawing library (e.g. OpenGL) and input systems (keyboard and mouse local to the window).<p>At the moment every application just implements `main()` and is good to go and we separate between kernel- and user-space (and a VM on top e.g. Android and Apple), and maybe this is too coarse.<p>I think pledge (<a href="http:&#x2F;&#x2F;man.openbsd.org&#x2F;pledge" rel="nofollow">http:&#x2F;&#x2F;man.openbsd.org&#x2F;pledge</a>) is also a step in the right direction however I would prefer it to be the other way around: an application goes through a setup process where it <i>gains</i> the capabilities it needs (in pledge it&#x27;s the other way around, you ask to drop them).