Module 3.2 — Operating Systems, Networks, and Distributed Systems

0. The Stack as Constitutions of Power

Treat the whole computing stack as nested constitutions: each layer defines what is permitted, what is visible, what is attributable, and what can be rolled back or rewritten.

1. Stacked Sovereignty Inside a Machine: Operating Systems

1.1 Root of Trust: Firmware → Hypervisor → OS → Containers → Processes

The practical hierarchy is real power: firmware and hypervisors can silently override “your OS.” In clouds, provider identity sits above your kernel.

1.2 Processes and Threads: Local Agents, Scheduling Law

• Process: address space + descriptors + identity (uid/gid/caps) + kernel metadata.
• Thread: execution context inside a process; shares memory/resources; owns registers/stack/PC.
• Scheduler: the allocator of CPU time; policy = law; cgroups = enforceable budgets.

1.3 Memory: Virtual Territory vs Microarchitectural Reality

• Virtual memory: page tables map virtual→physical + permissions; isolation at the OS boundary.
• Microarchitecture: caches/TLB/speculation can leak across boundaries; “logical privacy” ≠ “practical secrecy.”
• Runtime layer: sandbox VMs (JVM/WASM) add additional isolation contracts above the OS.

1.4 Concurrency: Local Distributed Systems

Threads are nodes; shared memory is the “network”; caches + reordering create partial views and delay. Race conditions, deadlock, and memory models are shared-reality failure modes.

1.5 Filesystems: Persistent Property and History

• Filesystems are a node’s property registry + historical archive: naming, metadata, consistency, recovery.
• Journals/logs are “append-only reality”; derived state is cache.
• Distributed filesystems immediately collide with partitions + coherence (CAP surfaces).

2. Networks: Inter-Sovereign Treaties, Routes, and Middleboxes

2.1 TCP/IP and the End-to-End Principle

• Internet layering: Link → IP → TCP/UDP → Application.
• End-to-end: correctness, reliability, encryption belong at endpoints; the network stays minimal.
• TCP/IP is architectural federalism: local autonomy inside networks, minimal law at interconnect.

2.2 Middleboxes, NAT, and IPv6

• NAT breaks strict end-to-end, creates chokepoints and policy engines; CGN makes users outbound-only by default.
• Overlays (VPNs, Tor, meshes) rebuild logical topology above hostile middleboxes.
• IPv6 restores addressability in theory; operational realities keep NAT alive.

2.3 Routing, BGP, and SDN: Who Controls the Paths

• BGP between ASes is policy routing: business logic decides paths; hijacks/leaks are route-level power.
• RPKI hardens origination but introduces new trust anchors (registries/cert chains).
• SDN centralizes control-plane logic: programmability increases—and so does concentrated leverage.

2.4 DNS, TLS, Web, CDNs: Application-Layer Sovereignty

• DNS hierarchy (root/TLD/registrar) is naming authority; seizure/poisoning is identity capture.
• TLS binds names to keys via CA trust stores; CT logs mitigate (not eliminate) misissuance.
• Web commons (Berners-Lee) is now mediated by browsers/search/CDNs: an application-layer meta-OS.

3. Distributed Systems: Shared Reality Under Failure and Attack

3.1 Failure Models and Adversaries

• Crash, omission, Byzantine faults; partitions, latency spikes, routing anomalies.
• Adversarial infra: cloud/ISP/CA/NTP as potential hostile dependencies.
• Sybil/eclipsing/partitioning: identity and topology are contested resources.

3.2 Time and Causality

• Clock drift + variable latency → physical time is non-universal.
• Lamport: happens-before, logical clocks; vector clocks for concurrency detection.
• External time oracles (NTP/GPS) create centralized trust anchors; protocol-derived time avoids them at cost.

3.3 Consensus: Agreement Under Constraints

• Safety vs liveness; FLP shows deterministic consensus impossibility in fully asynchronous systems with one crash fault.
• Practical consensus assumes partial synchrony + timeouts/randomization.
• Paxos/Raft (crash faults), PBFT (Byzantine faults); each is “shared law for ordered events.”

3.4 CAP and the Consistency Spectrum

• Under partitions, you cannot guarantee both strong consistency and availability in the formal model.
• CP rejects/delays to preserve single truth; AP serves and reconciles divergent views.
• Most systems live on a spectrum: linearizable → sequential → causal → eventual.

3.5 Transactions, 2PC, and Sagas

• Distributed ACID semantics require coordination; 2PC is simple but can block under coordinator failure.
• Sagas: sequence of local commits + compensations; embrace eventual consistency + replayable logs.
• Gray: transactions/logs as the spine of durable state and recovery.

3.6 Lampson: Capabilities and Hints

• Capabilities: authority as possession of unforgeable tokens; natural fit with crypto keys.
• Hints: performance accelerators that may be wrong; correctness must survive incorrect hints.
• Keep the trusted core minimal; surround with discardable speculative layers (caches, replicas, indices).

4. Cross-Layer Adversarial Surfaces and Governance

5. Design Law: Principles for Sovereign, Collapse-Ready Architectures

1. Model stacked sovereignty explicitly. Firmware, hypervisor, kernel, runtime, protocol, consensus are distinct jurisdictions.
2. Minimize global consensus surface. Use strong consensus only where a single canonical log is essential.
3. Design for partitions as the norm. Local-first operation + explicit reconciliation; make CAP choices explicit per subsystem.
4. Make logs the backbone of reality. Append-only logs authoritative; derived state is cache; guard integrity with hash chains/Merkle trees.
5. Use capabilities for authority. Possession of cryptographic tokens/keys; least privilege; small auditable check path.
6. Reclaim end-to-end where possible. Where NAT/middleboxes break it, use overlays and pluggable transports.
7. Treat time and identity as contested resources. Choose external time vs protocol time; define Sybil resistance in the threat model.
8. Engineer for diversity and anti-monoculture. Multiple implementations/operators/geographies for critical components.
9. Model upgrades and configuration as law. Safe rollout/rollback; config as code; version skew as normal.
10. Include human governance explicitly. Root keys, rotation, revocation, parameter changes, and dispute procedures are part of the system.

Canon Index (All Links)

Complete set used above, grouped by layer.

Operating Systems

• MIT 6.1810 / 6.S081 — OS Engineering
• xv6 (RISC-V) hub (book + code)
• OSTEP — Operating Systems: Three Easy Pieces
• Lampson — Hints for Computer System Design
• Gray — Why Do Computers Stop…
• Gray — The Transaction Concept
• seL4 verification paper (PDF)
• Comprehensive seL4 verification (PDF)
• Qubes OS — Architecture docs
• Qubes OS — Architecture Spec v0.3 (PDF)
• Tanenbaum — Amoeba Intro (PDF)

Networks

• Stanford CS144 — Networking
• CS144 lectures playlist
• End-to-End Arguments (PDF)
• RFC 791 — IP
• RFC 793 — TCP
• RFC 4271 — BGP-4
• RIPE NCC — RPKI docs
• IANA — DNS Root Zone
• RFC 8446 — TLS 1.3
• Berners-Lee — The Next Web (TED)
• Cerf & Kahn — Packet Network Intercommunication (PDF)
• Vint Cerf — Internet: Past, Present and Future (video)
• Clark — DARPA Internet Protocols (PDF mirror)

Distributed Systems

• MIT 6.824 — Distributed Systems
• Lamport — Time, Clocks, Ordering (PDF)
• FLP impossibility (PDF)
• Paxos Made Simple (PDF)
• Raft (PDF)
• PBFT (PDF)
• Why Do Internet Services Fail… (USENIX)
• SE Radio — CAP Theorem (Brewer)
• SE Daily — CAP (Brewer)

Films / Documentaries

• Computer Networks: The Heralds of Resource Sharing (1972)
• The Code: Story of Linux (2001)
• Triumph of the Nerds (1996)