back
2 comments
That's a weird opinion just like all extreme opinions. It's not meant to be perfect - it's a layer of security that mitigates some issues and hopefully exposes as few new ones as possible. Virtualisation kills almost all local IPC / filesystem / shared memory possibilities of privilege escalation through other services. It even mitigates most kernel level exploits, because after that you'll still need to break out of the VM itself.

TLDR: P(non-root-vm-breakout-not-requiring-app-breakout) < P(app-breakout) and P(non-root-vm-breakout) < P(local-pe | system-service-exploit)

Huh, Linus Torvalds is an angel in comparison to this person.