Unikernels are back because the practical frictions that once made them difficult have been removed by modern tooling and large models. A unikernel bundles application code and the minimal OS into one image, eliminating userland, shells, and many attack vectors that let intruders pivot and exfiltrate. That operating-system-as-legacy-design-debt matters now: frequent kernel and userland patching fails to stop real risk (recent KVM compromises illustrate this), whereas a single-purpose unikernel reduces runtime surface area and forces attacks to be targeted at application source. Ring separation and other traditional objections are solvable today, and for high-assurance use cases formally verified kernels like seL4 remain the other option.
Practical gaps - missing libraries, storage, and drivers - are now trivial to close with AI-assisted porting, reproducible tests, and overlays; examples include porting Stripe clients and even mkfs.xfs byte-for-byte using agents. Cloud-shaped storage patterns (S3 plus NVMe cache) replace bulky local stacks. Nix machine tests and overlays simplify integration and supply-chain fixes. A worked example shows an OCaml-based unikernel fleet (SPACELEANS) implementing NTP, networking, logging, OpenAI/Anthropic clients, payments, PII-safe logs, and a Microsoft Orleans-style distributed actor runtime, proving a distributed unikernel OS is feasible in days rather than years. Languages like OCaml, Rust, and Haskell are well suited today, though compile-time costs remain an operational consideration.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Vinay Prasad criticizes Terrence Tao's view that patients need human understanding before accepting AI-derived cancer cures, arguing that many cancer drugs lack fully understood mechanisms yet are still used. He emphasizes that positive phase 3 trial results can be enough for treatment, regardless of complete mechanistic knowledge, highlighting the urgency and desperation in cancer treatment decisions. (drvinayprasad.com)
The US Justice Department is investigating ABC, CBS, CNN, NBC, and Fox News for potentially violating federal competition laws by suspending White House pool coverage of Donald Trump. The networks temporarily stopped sharing footage after Trump blocked certain outlets from covering events. (bbc.com)
The U.S. Supreme Court considered a case involving alleged breaches by Intel fiduciaries for investing in hedge funds and private equity in 401(k) plans. A ruling favoring Intel could encourage more employers to include alternative investments in retirement plans, despite potential slow adoption by large companies. (cnbc.com)
UK water companies earned over £340 million last year by processing industrial and commercial wastewater at sewage plants that do not effectively remove chemical pollutants. Experts say this practice allows harmful pollutants to flow into rivers, seas, and farmland, raising environmental concerns. (theguardian.com)
A raw goat milk farm in California sold unpasteurized milk that sickened two children, including a 17-month-old girl. Regulators did little to penalize the farm despite evidence of violations and health risks. (propublica.org)
Hackers are exploiting Google Ads and Bing redirects to distribute Claude ClickFix malware attacks. These tactics are part of broader cyberattack campaigns targeting organizations and individuals online. (bleepingcomputer.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.