Greg Kurtzer's Ginux is now a userspace kernel

The dude who says, "Give me a microkernel, use QNX request/receive/respond for syscalls, it only runs WASM blobs, device drivers are isolated user mode processes, it only supports HTTPS on one network interface, and the file system is readonly ExFAT" will probably get something different.

I hate low value LLM prose (slop) too, but if you ask it to write like Herman Melville, you'll get few "it's not this, it's that".

Maybe you do still get the same kinds of errors when you ask for VMS, 64 bit memory safe DOS, or a Unikernel. I dunno, but it seems like something that could be improved when it's identified.

Just to clarify: I didn't mean the effort to find and fix a vulnerability in PHP (although that is also difficult). I meant the effort to reformat your system, investigate what else was compromised, and recover from backups after you get hacked through an exploit in PHP.

You probably don't use every last function, and you might be underestimating what became possible this year. You could have a model search for the features you use. You could have it loop until your existing code passes with the substitute. You could have it rewrite your code to use fewer features while still passing your existing tests.

I'm not saying you have to do this, but I think we should question which of our old approaches are based on old constraints.

Rolling back is easy as long as you understand where the state, if any, is which is actually the hard part of any application. At least with containers you have all of them stored in a well defined registry, while with VMs you would be rolling your own VM snapshot storage system. Not super complicated to do in the grand scheme of things, but it’s another thing you need to get right. But VMs/applications that can rollback would be just as easy (if not easier) to rollback with containers.

Remember the submission about how Auto Review is safe? Their standard of safe is that it will take a playwright dependency of another project in your home directory and add playwright based tests to your current project that hasn't declared playwright as a dependency. Amazing.

The issue literally isn't even about a hypothetical security argument anymore. Your sandbox is now a policy that tells the agent what it is allowed to do or not.