Hacker News Reader

Numerous centralized authentication services are available for Linux and Windows and others for a long time.

You're absolutely correct, and like I said a lot of people run their Plan 9 systems with all the services on one box, which kills a lot of the security advantages.

However, if you compare setting up a Plan 9 auth server to setting up a Kerberos server... well, basically anything to do with Kerberos makes me long for death. The Plan 9 auth system is one of the best things they made and I highly recommend checking out the paper: https://css.csail.mit.edu/6.858/2013/readings/plan9auth.pdf

Can the component machines be run as VMs on fewer / one physical machine? It would make for a better QubesOS then.

Yes, I've used minimega to run a bunch of Harvey VMs for experimental use. https://github.com/Harvey-OS/harvey/wiki/Using-minimega-to-r...

If you emulate a dozen machines on one physical machine, then a single exploit can traverse them all. If you pack a dozen "single board computers" in a case and give each a single function, then entire classes of attack are ruled out.

Reply on news.ycombinator.com