[walterbell]

In this OS, are chroots enough to "withstand zero-day attacks in userspace", e.g. in combination with other hardening features?

[fleitz]

Yes, the lack of a network stack prevents the most common attacks, and drastically reduces the usefulness of gaining control of the system.

[unwind]

I had to look up "zero-day attack", but it really meant what I thought it did, i.e. a previously unreported ("fresh") exploit (http://en.wikipedia.org/wiki/Zero-day_attack).

I don't understand this usage, which makes it sound as if zero-day attacks are a technical term, a category of attacks. Can anyone clarify?

[walterbell]

It's more of a business term, e.g. http://en.wikipedia.org/wiki/Vupen