4 ms·

It is foolish to assume that HSAs don't already have access to whatever you, some guy on the Internet, know. So you can be an asshat, or do the right thing and

It is foolish to assume that HSAs don't already have access to whatever you, some guy on the Internet, know. So you can be an asshat, or do the right thing and try to 'protect the muggles' by letting information be available to all. They might feel threatened enough to pull valuables from unsafe places (such as networked computers).

nickpsecurity 11y ago
It's not foolish if one understands high assurance security well enough that his recommendations preempted or predicted many specific things in TAO catalog. And most other stuff they did. It's easy once you understand nature of INFOSEC plus their nature. No they don't have my methodology: I never put it into digital form. Use paper is rule No 1 in high security. The only people I talked go were ideological who I vetted. It's mostly in my head and on paper hidden well in areas with tamper-evidence. They're watching my comms but no black bag jobs. So the method is safe for now. And what are you going to do with it? All of us high security engineers who arent in defense, sell-outs, etc are typically ignored by mainstream INFOSEC. People don't do shit even when we have evidence. People do less than that on open HW even with cheap FPGA's. You really think one of us is gonna burn our own security just to publish an obfuscation people won't use or give us anything for? Like hell... You want write-ups and design details on high security I got plenty of that. Keep master copies on Schneier's blog. Will send them. Not giving away something this big that you cant even afford to use. Not till I have a replacement...
- calgoo 11y ago
  There is also this thing of legacy code... What if 3, 5, 10 years from now when you have moved on to your next super project, but someone has based system XYZ on your code. If they need to write a driver or similar, I'm sure they would be a lot happier to have a documentation that clearly states a design etc then a document saying: "This was hidden so big bad guys cant look!".
  - nickpsecurity 11y ago
    High assurance requirements going back to Orange Book's A1 class said the source code and evaluation evidence comes with the software. Further, customers were encouraged to re-run the tests & compilation, generate the system on-site, set it up according to secure configuration guide, and report any problems back to vendor. They become part of the evaluation process although real work was to be done by security professionals at evaluation lab and NSA's pentesters. Here's an example of one from one of father's of INFOSEC that handed NSA's ass to them in 2 years of pentesting: http://www.iwia.org/2005/Schell2005.PDF http://www.iwia.org/2005/Schell2005.PDF The original was based on custom hardware and firmware because Schell etc had good foresight. :) It was put on Intel because DOD and commercial sector wanted commodity products. So, probably issues at those layers that could breach security. Nonetheless, the kernel was what was designed with high assurance and will illustrate nicely what comes out of that. Note that this was the 1980's when it was designed. Still more secure, easier to review, and easier to extend than most modern software... So, I'd have to supply customers the source to meet your requirement. I could also show them how to protect it. However, thanks to design approach, a high assurance proprietary system is easier to work with than a low assurance FOSS system. It's because the process absolutely forces that design to be a simple, modular, layered, and correct as possible. I wrote up some links on how that's done here in context of subversion and hardware: https://news.ycombinator.com/item?id=10478742 https://news.ycombinator.com/item?id=10478742

nickpsecurity 11y ago

It's not foolish if one understands high assurance security well enough that his recommendations preempted or predicted many specific things in TAO catalog. And most other stuff they did. It's easy once you understand nature of INFOSEC plus their nature. No they don't have my methodology: I never put it into digital form. Use paper is rule No 1 in high security. The only people I talked go were ideological who I vetted. It's mostly in my head and on paper hidden well in areas with tamper-evidence. They're watching my comms but no black bag jobs. So the method is safe for now. And what are you going to do with it? All of us high security engineers who arent in defense, sell-outs, etc are typically ignored by mainstream INFOSEC. People don't do shit even when we have evidence. People do less than that on open HW even with cheap FPGA's. You really think one of us is gonna burn our own security just to publish an obfuscation people won't use or give us anything for? Like hell... You want write-ups and design details on high security I got plenty of that. Keep master copies on Schneier's blog. Will send them. Not giving away something this big that you cant even afford to use. Not till I have a replacement...

calgoo 11y ago
There is also this thing of legacy code... What if 3, 5, 10 years from now when you have moved on to your next super project, but someone has based system XYZ on your code. If they need to write a driver or similar, I'm sure they would be a lot happier to have a documentation that clearly states a design etc then a document saying: "This was hidden so big bad guys cant look!".
- nickpsecurity 11y ago
  High assurance requirements going back to Orange Book's A1 class said the source code and evaluation evidence comes with the software. Further, customers were encouraged to re-run the tests & compilation, generate the system on-site, set it up according to secure configuration guide, and report any problems back to vendor. They become part of the evaluation process although real work was to be done by security professionals at evaluation lab and NSA's pentesters. Here's an example of one from one of father's of INFOSEC that handed NSA's ass to them in 2 years of pentesting: http://www.iwia.org/2005/Schell2005.PDF http://www.iwia.org/2005/Schell2005.PDF The original was based on custom hardware and firmware because Schell etc had good foresight. :) It was put on Intel because DOD and commercial sector wanted commodity products. So, probably issues at those layers that could breach security. Nonetheless, the kernel was what was designed with high assurance and will illustrate nicely what comes out of that. Note that this was the 1980's when it was designed. Still more secure, easier to review, and easier to extend than most modern software... So, I'd have to supply customers the source to meet your requirement. I could also show them how to protect it. However, thanks to design approach, a high assurance proprietary system is easier to work with than a low assurance FOSS system. It's because the process absolutely forces that design to be a simple, modular, layered, and correct as possible. I wrote up some links on how that's done here in context of subversion and hardware: https://news.ycombinator.com/item?id=10478742 https://news.ycombinator.com/item?id=10478742