Yeah, all security design guarantees are as good as the implementation at the end of the day. All the fancy hashing and encryption math in the world isn't gonna save you from an erroneous `"" == ""` check or an invalid reference check.
replyI was replying to OP saying it's the same "approach" as Xen, if your preference is "approach" based. It's fair though to point to Nova's smaller code base. It's becoming an important metric for me in general (how big is the code base). It's not a bullet proof thing, but having a smaller code base is a positive sign in 2026 for me.
Novas core seems to be formally verified which rules out a vast amount of bug categories that can happen with xen, including this one
replyInteresting, I'll have to learn more about Nova.
replySee Udos most recent talk at 3mdeb Boot Mastery Conference.
replyHe is an ex Intel CPU engineer and the depth of his thought into the security design had me questioning my life choices.
https://youtu.be/RbL65gVzhNk for anyone else looking for it
replyThank you. I'll definitely check that out.
replyhaving worked with AWS, xen had a lot of very bad vulns over its lifetime as well.
replythere's no magic.
Now compare to Linux, which is the point raised. Nobody said alternatives like Xen are perfect... but my oh my, some are much better in this regard.
reply