IONA OS Developer Publicly Lists Critical Security Flaws Found in Custom Operating System

A developer building IONA OS, a custom Rust-based operating system, has publicly disclosed a series of significant security vulnerabilities discovered during an internal audit. Among the flaws are unencrypted local file storage, a keystore that uses trivial XOR instead of real encryption, and an onion-routing feature that provides no actual anonymity despite appearing functional. The OS also lacks secure file deletion, duress passwords, and hidden volume support — features considered essential for high-risk users such as journalists and civil servants. The developer has outlined specific fixes for each issue, including integrating ChaCha20-Poly1305 encryption into the file system, adding a shred function, and either implementing genuine anonymous routing or removing the feature entirely.