Top all-time · #3998
Gernot Heiser
Personal blog · microkerneldude.wordpress.comsystemssecurity
Gernot Heiser writes microkerneldude, a personal blog at microkerneldude.wordpress.com about systems and security. Since 2012, 19 different Hacker News readers have linked it 34 times, most often “Verified software can (and will) be cheaper than buggy stuff”. It is still writing: the last post was on 2025-04-27, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link Gernot Heiser's blog as a source on microkernels, seL4, hypervisors and formal verification. Commenters cite its posts to support points on OS security and architecture.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Random rants and pontifications by Gernot Heiser
Most-linked posts?
- Verified software can (and will) be cheaper than buggy stuff4 people · 6 mentions · first linked 2016-06-16
- SeL4 Design Principles3 people · 3 mentions · first linked 2020-03-10
- Microkernels Really Do Improve Security2 people · 3 mentions · first linked 2018-08-23
- 10 Years SeL4: Still the Best, Still Getting Better2 people · 2 mentions · first linked 2019-08-06
- SeL4 is verified on RISC-V2 people · 2 mentions · first linked 2020-06-09
What Hacker News says?
>That's not what I said. I said that merely creating a verified formal specification of a language is not in itself a good path to increasing correctness, and I wouldn't focus on that as a significant cause for concern given all others. This seems to be poorly considered. Isn't it easier for an OS and a language to be verified once even at great cost than hoping future billions of lines of developer code already pro…
Comment linking /2016/06/16/verified-software-can-and-will-be-cheaper-than-buggy-stuff/
on “Facebook Libra Is Architecturally Unsound”Submitted SeL4 is verified on RISC-V as a story · 244 points
HN discussionGernot Heiser, the leader behind seL4, thinks so: https://microkerneldude.wordpress.com/2016/06/16/verified-so... They built infrastructure to build verified OS stuff faster/cheaper. For example, they reimplemented ext2fs for Linux.
Comment linking /2016/06/16/verified-software-can-and-will-be-cheaper-than-buggy-stuff/
on “Kaspersky OS”Submitted SeL4 on RISC-V Verified to Binary Code as a story · 157 points
HN discussion>Could you clarify "Better choice"? KVM is, like VMware, a Type 2 hypervisor. [1] Xen is a proper Type 1 hypervisor. [1] https://microkerneldude.wordpress.com/2010/10/14/much-ado-ab...
Comment linking /2010/10/14/much-ado-about-type-2/
on “Qubes OS: A reasonably secure operating system”Submitted 10 Years SeL4: Still the Best, Still Getting Better as a story · 150 points
HN discussion>Sure, VxWorks is safe. That goes beyond strawman. Try reading: https://microkerneldude.wordpress.com/2018/08/23/microkernel... For as long as Linux is a monolithic design, the whole kernel is going to be part of the TCB. And thus, you should be skeptical of any claims of Linux providing security.
Comment linking /2018/08/23/microkernels-really-do-improve-security/
on “OpenBSD 6.4 released”Submitted SeL4 Design Principles as a story · 146 points
HN discussionNothing to do with the license. These systems do things that Linux just can't. Linux is no RTOS, nor does it have a pure microkernel architecture. It can't do anything where latency guarantees are needed (hard realtime) nor high assurance, nor any actual semblance of security. I suggest these posts: https://microkerneldude.wordpress.com/2018/08/23/microkernel... https://blog.darknedgy.net/technology/2016/01/01/0/
Comment linking /2018/08/23/microkernels-really-do-improve-security/
on “OpenBSD 6.4 released”Submitted The SeL4 Foundation: What and Why as a story · 104 points
HN discussionCommon hypervisors like ESX and Xen definitely aren't like microkernels, though they'd be more secure if they actually were. ESX and Xen are more like monolithic kernels. The problem is that in practice they've become mini-kernels with their own driver systems and increasingly large code surfaces, recapitulating the mistake of monolithic kernels. seL4 actually can act as a hypervisor, and their build framework comes…
Comment linking /2016/04/14/so-the-fbi-cracked-the-iphone-with-a-zero-day-and-hardware/
on “CLIP OS – France’s cybersecurity agency’s open source, secured operating system”Submitted Where Is SeL4 Heading? as a story · 22 points
HN discussionYes. https://microkerneldude.wordpress.com/2016/06/16/verified-so...
Comment linking /2016/06/16/verified-software-can-and-will-be-cheaper-than-buggy-stuff/
on “Formal Verification: The Gap Between Perfect Code and Reality”Submitted OK Labs Story: The Beginning as a story · 10 points
HN discussionOKL4 was both a microkernel and hypervisor. They coined term microhypervisor to differentiate that. https://microkerneldude.wordpress.com/2008/04/03/microkernel... NOVA is an open-source micro-hypervisor available in GenodeOS that similarly combines hypervisor functionality with a microkernel-like design: http://hypervisor.org The Xen hypervisor also got many of its design elements from the Nemesis OS, which had a l…
Comment linking /2008/04/03/microkernels-vs-hypervisors/
on “The Jury Is In: Monolithic OS Design Is Flawed [pdf]”Submitted SeL4 Micro Kernel Design Principles as a story · 4 points
HN discussion> The correct solution of course is just to use a memory safe language. Memory safety isn't enough, you need more. (More reading: https://microkerneldude.wordpress.com/2013/05/03/closing-the... ) Even if you trust the language to provide the isolation you need, today's requirements can't possibly be met by such a system. Maybe in 50 years once all software has been rewritten.
Comment linking /2013/05/03/closing-the-gap-real-os-security-finally-in-reach/
on “Microkernels are slow and Elvis didn't do no drugs”Submitted seL4 Design Principles as a story · 4 points
HN discussionThis was presented in 2020-01, where proof was “due Q1’20”. FYI, Proof got finished in 2020-06: https://microkerneldude.wordpress.com/2020/06/09/sel4-is-ver...
Comment linking /2020/06/09/sel4-is-verified-on-risc-v/
on “Verified seL4 on secure RISC-V processors”Submitted Verified software can (and will) be cheaper than buggy stuff as a story · 4 points
HN discussionGernot Heiser states it here: https://microkerneldude.wordpress.com/2008/04/03/microkernel... Their highly-efficient microkernel has been doing so well that most people using it don't know it's in their smartphones. Do most virtualization solutions have a similar impact on user experience? ;)
Comment linking /2008/04/03/microkernels-vs-hypervisors/
on “A reimplementation of NetBSD using a Microkernel [video]”Submitted SeL4 Integrity Enforcement Proved for RISC-V as a story · 3 points
HN discussionseL4 just celebrated its 10th anniversary. seL4 isn't widespread in COTS systems but rather in high assurance government systems as explained in this blog post: https://microkerneldude.wordpress.com/2019/08/06/10-years-se...
Comment linking /2019/08/06/10-years-sel4-still-the-best-still-getting-better/
on “Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks”Submitted “Trustworthy Systems Research Is Done” – Are You Kidding, Csiro? as a story · 3 points
HN discussionYou (like Linus) are right in that microkernels don't provide much of a security benefit in-and-of themselves. But taking full advantage of other advances in information security research requires a new OS architecture. The financial consequences of poor security are becoming more severe and the cost of developing high-assurance code is dropping rapidly [1]. If we haven't crossed the cost/benefit ratio yet, we are v…
Comment linking /2016/06/16/verified-software-can-and-will-be-cheaper-than-buggy-stuff/
on “Linux is Obsolete (1992)”Submitted Can seL4 reduce the cost of satellites? as a story · 3 points
HN discussion>I'm not sure an actual implementation buys you much over the NT approach. As an introduction to that, I'd suggest reading https://en.wikipedia.org/wiki/MINIX_3#Reliability_policies as most of that is tied to the pure microkernel multiserver approach, with strictly only the microkernel running in supervisor mode. If you want to go into more depth, then I'm going to suggest https://ts.data61.csiro.au/projects/TS/publ…
Comment linking /
on “Ask HN: What's a reasonable microkernel-based OS for desktop usage?”Submitted Verified software can (and will) be cheaper than buggy stuff as a story · 2 points
HN discussionKeep in mind Xen is bloated beyond belief, and all of this bloat is running in supervisor mode. It being an actual type 1 hypervisor makes it significantly better than approaches such as Linux KVM or freebsd bhyve, but the TCB is still too big. A better approach is to run the VMM (which handles VM exceptions) as a normal user process under a microkernel. seL4 implements such an approach, with the added benefits of c…
Comment linking /
on “Ask HN: What's a reasonable microkernel-based OS for desktop usage?”Submitted Giving it away? Part 2: On microkernels and the national interest as a story · 2 points
HN discussion
