AFAIK, the first time I heard about "Project Oak" was about four or five years ago.
This predates Apple's Private Cloud Compute.
## Sealed Computing
A canonical use of Oak is to build privacy-preserving sealed computing applications.
In a sealed computing application, a node (usually a client device) sends data to an enclave application (usually a server), which processes data without the service provider hosting the enclave application being able to see the inputs, outputs, or side effects of the computation.
[1]: https://github.com/project-oak/oak?tab=readme-ov-file#sealed...
---
Seems like an attempt at a privacy-preserving alternative to running your whole phone OS image on a server?
Waitasec - ZOOM AND ENHANCE!
> users control their own devices
I’ll believe that when Apple lets me downgrade my iOS version.
I'm fine with more controls in place, a safer internet is clearly a social win that would reduce life alerting fraud, scams etc. If power users want to go to their peer-to-peer cesspool then go for it.
2019
This is exactly the purpose of MRENCLAVE in Intel SGX remote attestation quotes (and similar fields in other TEE platforms), and proving the software identity to remote clients is a common use case.
Maybe I misunderstand - is that what you mean, or is there another use case you are looking for?
Nitro enclaves also doesn't have all this high level infrastructure of composing microservices like this does
I think (but somebody smarter might correct me) that with nitro enclaves you also need to trust Amazon. Whilst with this you need to trust AMD, but don't need to trust GCP
Nice thing about nitro enclaves is that the Linux bits aren't tied to OCI. E.g. Monzo uses nix to build their enclave images https://github.com/monzo/aws-nitro-util
edit: love that the community is not silo’d into a proprietary chat platform as well:
> We welcome contributors! To join our community, we recommend joining the mailing list.
- https://github.com/project-oak/oak?tab=readme-ov-file#gettin...
I really wish more open source projects used mailing lists.
1) decentralized means of communication
2) able to join these communities from any type of environment (ie, corporate hell hole) without much friction. With discord, slack (especially at fortune 500s). It usually involved a whole process of approvals to get the damn thing installed and punch a hole through the firewall to get access to the service.
No, using a personal email and device for what I consider contributing from a work aspect (ie, submitting patch to OSS to solve specific problem with project) is not acceptable.
It’s security-focused technology. Rust has huge advantages over Go in this area.
Could you name some advantages? I would agree Rust has huge advantages compared to C/C++, and Rust also has a much bigger presence in the "security space". But I would say that's more because of Rust's lack of GC, smaller footprint which works in embedded systems etc.
I guess you could say that Rust's type system being more expressive might eliminate certain classes of bugs, which have security implications. But "huge advantages"?
(Honestly I'm not flame baiting, I'm genuinely curious if my worldview is wrong)
Go usage inside Google is actually quite low, people talk a lot about Go being a google project but in reality its a project made by some people who work at Google.
When I last checked it was a bronze supported language (with C++, Python and Java being Gold).
I also don't believe that content creators have any kind of legal or moral right to force the general public to "consume as intended". For instance, I've got a shelf in my office that's built with supports that are designed for plumbing. I have not consumed these pipes as intended.
And this one: https://security.googleblog.com/2022/10/SecurityofPasskeysin...
I've been fortunate to be paid by Google to hide user data from Google since 2016. Not many companies would shell out anything for this sort of privacy feature.
As for the Oak stack, they win the race. It is the only stack that currently provides full hardware attestation covering 100% of the code running in the enclave, and 100% of it is open-source. There are other good efforts, such as CoCo containers with their Key Broker, but so far they only cover the initial boot firmware, not the full set of software running inside the enclave.
Kudos to the Oak team!
They don't call null/nil the billion dollar mistake for nothing.