Scott Lowe

This is pretty interesting, but unfortunately their intro page doesn't do a good job of explaining why. (For instance, they use the word "unprecedented" without really saying what makes Arrakis different from previous exokernel-like designs.) I'll try to summarize what I got out of skimming the paper[1]:

When you have multiple applications running on the same machine, you need some way to safely share resources between them; for example, incoming network packets are a resource. A kernel handles this by keeping a data structure mapping sockets to processes, and demultiplexing data that comes in from the network card. Hypervisors work the same way, except at the level of virtual machines rather than processes.

Arrakis does the same thing, but relies on hardware support in the network card to dispatch packets to the right process. This relies on a standard called SR-IOV[2] which allows the OS to configure a PCI device to present itself as multiple virtual subdevices. The kernel programs the NIC to dispatch packets to different buffers depending on the incoming MAC address; after that, packets can be dispatched with no kernel involvement at all. Similarly, you can tell a disk controller to present a particular extent of a disk as a new virtual storage device.

The blurb about memory protection seems to be a red herring, because as far as I can see they haven't done anything to change that. There's still a kernel, which handles requests for resource mappings, and processes are…

Besides the usual public/private key system, OpenSSH supports a less-used system called user certificates.

User certificates achieve the same purpose as your normal key but instead of pre-installing your public key on the server, you present a certificate during authentication and the server checks that it's signed by a trusted authority - it's more or less a PKI similar to that used for HTTPS, etc.

One of the key advantages of this approach is that the CA can enforce limits on the key, such as validity periods and disabling SSH features like port forwarding, binding a certificate to only run a particular command, or only allowing it's use from a specific IP.

BLESS appears to be a piece of infrastructure for autonomously signing these certificates - on it's own that gives you benefits like a proper audit log, but it seems that it's real purpose is to enable an SSH bastion host[0] to generate ephemeral keys for the servers it accesses.

[0]: http://blog.scottlowe.org/2015/11/21/using-ssh-bastion-host/

Like other commentators have already mentioned but the openssl suite already solves these problems and even more complex ones

For example:

Specifying different keys different servers

Host github.com

User git IdentityFile ~/.ssh/id_rsa_github Host myserver

User username IdentityFile ~/.ssh/id_rsa_myserver Reuse SSH connections for multiple sessions

https://blog.scottlowe.org/2015/12/11/using-ssh-multiplexing/

https://blog.poespas.me/posts/2024/04/27-optimizing-ssh-connections-with-multiplexing-and-control-master/

Host *

ControlMaster auto ControlPath ~/.ssh/sockets/%r@%h-%p ControlPersist 600 Other than that, you can also do ssh agent forwarding, port forwarding etc. These are all crucial functions that user like me need when we access remote machines.

I hope you take this as constructive criticism and not a knockdown on your work. You've created and released something that's great but this site usually brings more advanced users.

>I mean, wtf? With open source, there is at least discussion and education about something like this.

You'd be surprised -- unless you follow dev forums for various elements of your DE/distro.

macOS moves because it updates into a clean system as far as those configs are concerned.

In any case, it takes like 2 minutes to write a shell script to deploy your pf.conf/automount config after every such upgrade, and 1 seconds to use it. Or to look for the proper, permanent, way to do it: https://blog.scottlowe.org/2013/05/15/using-pf-on-os-x-mountain-lion/

With brew and brew mas you can also automate command line and GUI app installations, even custom font installs, among other things.

I can get up and running into a new machine in ~2 hours from a clean install with an automated shell script and get all my apps and cli apps, custom shell aliases/scripts, configuration for dev tools like VSCode and IntelliJ, documents (from TM/Dropbox) and so on.

Very excited about the fork's improvements given the lack of responsiveness in core repo. I've hit some of these bugs including the registry issue. Thank you for open sourcing it.

I've used a combination of ProxyCommand directive in ssh config + a script it calls w/ the `%h` (host) to unpack what the correct instance-id is (like @galanwe). For the proxycommand, you can embed an `aws ec2-instance-connect send-ssh-public-key` for pushing a key valid for 60s followed by activating the SSM session.

The downside is it adds ~20-30s delay in connection due to the API requests, but if you're making repeated rapid requests to same instance, I recommend looking into ssh's ControlPath, ControlMaster and ControlPersist to keep a longer lived session that's re-used for client re-connections (ref: https://blog.scottlowe.org/2015/12/11/using-ssh-multiplexing/)

[Edit to add that I've hit the registry bug myself]

I'm sure this might be an unpopular opinion here, but my experience has been that when you do normal business collaboration - WebEx, etc. - in Linux, you spend more time fighting to make things work than you do actually working. Chrome and the proliferation of webapps has helped this somewhat, but it always ends up being something.

Scott Lowe did a pretty interesting series of blog posts [1] on it and ultimately ended up back on a Mac because it just killed his productivity and called it "death by a thousand cuts". This mirrors my experience. I want to be on Linux and there's a lot to love, but it's just not..stable? evolved? polished? (not sure what the right word is) enough to be a daily driver for most non-development oriented people.

[1] https://blog.scottlowe.org/2017/10/25/linux-migration-wrap-up/