To really be real if air-gapping is a significant mitigation for your risk profile then you are likely the target of one of those rare APT's. You should probably also be using a memory safe language if you think you need air gapping.

That was the most brilliant part of Rust lang design, when I thought about it.

There will always need to be unsafe ops in highest performance, low level coding.

But in the vast majority of use cases, there only need to be a few.

So huge security win being able to isolate those vs "somewhere in the entire codebase."

As other commenters have said, you can do it a bit at a time, converting non-core kernel code to Rust at the edges. Another route to memory (and other) safety would be the C -> WASM -> C route that effectively rewrites/transpiles code to operate within its own sandbox, which also has the advantage that it could at some later date support modules written in languages other than C.

Yeah, I've wondered a bit if the Spectre class of vulnerabilities was discovered a couple decades sooner if it would have changed the course of history there.

Hurd any day now, right?

I do wonder what this landscape could have looked like if all of the effort had gone behind a Mach-based microkernel. I read all of the back and forth between Tanenbaum and Torvalds. At the time, I was just so excited to see "free and open" winning.

I should specify that the XNU Kernel from Darwin/OSX took a lot of my attention when it first premiered.

This is true for server systems too. I've often had problems which were ultimately only solvable by rebooting large fleets of servers.

Had the servers been running microkernels instead, updating services without full restarts would have been trivial in almost all cases.

It's just a better approach overall. I curse the path dependency that led to the current situation.

They might win in the long term. Linux is moving in a micro-kernel direction with things such as netmap, io_uring, DPDK and SPDK.

So far 61 files [0], vs 52k for C, so about 0.1%.

[0]: https://github.com/search?q=repo%3Atorvalds%2Flinux++languag...

Most of the interesting work is not yet upstreamed. A particularly interesting example is the Apple Sillicon GPU driver in Asahi Linux.

Last I checked still very early days with most of the work/experimentation happening in the driver space. However, it doesn't seem like its facing a lot of resistence and Torvalds seems reasonably positive about it atm.

IIoT stands for "Industrial Internet of Things"

So it's your contention that the comment should read, "At least my usecase has C completely disconnected from the internet. I have no idea how [using memory-safe languages] is going to work at the OS level."

I struggle to understand the comment. Do these two sentences relate to one another or is the second one a non-sequitur?