4 ms·

Nick, our programming ecosystem barely satisfies the basic principles of software fault tolerance, much less self-healing systems. High assurance? Multiple inde

Nick, our programming ecosystem barely satisfies the basic principles of software fault tolerance, much less self-healing systems. High assurance? Multiple independent levels of security (MILS)? Covert channel resistance? Completely out of the question! That said, it is somewhat true that when you reduce the intelligence agency activities to targeted surveillance with employment of 0-days, the onus falls more and more on industry adopting HA. Yet one must not discount that how 0-days are even procured can involve questionable deeds. Furthermore, when the NSA's offense model is targeted attacks with 0-day deployment, an incentive is created to pump these 0-days by subverting cryptographic standard bodies. The market for 0-days is a) adversary and b) contestable, which is a lethal combination that promulgates black bag and kleptographic techniques. We must also be willing to assume that in any interventionist statist society, the property of domestic surveillance is not a unique event or something that can be eradicated, but a constant cyclical factor akin to a business cycle that may only be mitigated.

nickpsecurity 11y ago
"Nick, our programming ecosystem barely satisfies the basic principles of software fault tolerance, much less self-healing systems. High assurance? Multiple independent levels of security (MILS)? Covert channel resistance? Completely out of the question!" Original high assurance systems were done with Pascal, etc. Not much required in terms of programming past type and memory safety, esp strong interface checks. Plus easily understanding how that language becomes code with ability of compilers to transform it (eg auto-insertion of checks). More about a clear description of how it works, clear security policy, evidence they correspond, and implementation that maintains the same. As in another comment in this thread, small changes in hardware or OS's alone would create great increases in security. Far as the other requirements, software MILS just takes a microkernel with capabilities, periods processing, virtualizable hardware, and the right scheduler. A covert channel analysis via Kemmerer's Shared Resource Matrix can be done by a junior staffer with guidance and little time. That usable, prototypes of secure systems were done by small academic teams with 1990's and early 2000's tech shows it's well within reach of today's programmers. There's just an issue of willingness. Just look back at all the times I wrote up a secure-by-design system and how many people jumped on bandwagon to try to build their own. I can count them on my hands. "Yet one must not discount that how 0-days are even procured can involve questionable deeds." That's the subversion risk. The EAL6-7 development processes going back to Orange Book are designed to partly counter that. I add certified compilation, mutually suspicious parties doing analysis, diverse hardware, and so on in my requirements. Gotta address it all. Teams with little resources should focus on ability to detect, trace, and recover rather than prevent. Prevent what they can but only so much staff and time... "the property of domestic surveillance is not a unique event or something that can be eradicated, but a constant cyclical factor akin to a business cycle that may only be mitigated." That's an interesting thought. There have been cycles in my country. What worries me is the cyclical nature seems to be ending. We haven't seen the mass protests of police state activity that we wanted. The abuses revealed by Manning and Snowden led to griping followed largely by inaction. We've only seen American power increase even after the parties changed. The 180 of Obama administration on the key issues further suggests strong, covert influence that exists across parties and time. I wished we got something like Iceland in 2008 but America is a fake democracy: people did nothing, are mostly doing nothing, and TPP situation is set to confirm that trend. It's the new cycle.
- vezzy-fnord 11y ago
  The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure. Recursive restartability, microrebooting, state transfer to stable storage, event logs for fault recovery and piecewise determinism via replay of non-deterministic events, and many other hosts of options are all language-agnostic. Of course, many mission-critical projects will mandate redundancy through n-version programming where you have say a C implementation and Ada implementation of the same spec running concurrently with some failover scheme. Point is most of it is architectural and interface-related, not necessarily language-related. Hell, L4 was written in ASM at first. Since we can't get that, but instead mostly rely on cargo culting like "Haskell is magic pixie dust because math" for our software safety and availability, I find the prospects of careful HA research (which is more mathematically rigorous) to be daunting. Software MILS and separation kernels are promising, particularly what Muen does with the Intel VT-x extensions and its rather abundant configuration tools. Getting that deployed is going to be an uphill battle given fault tolerance's neglect, but also because many might perceive the static resource allocation to be anathema to "high scalability". I think you overestimate public resistance to surveillance. The Church Committee came and went quickly, and was forgotten and dismissed over the legislative band-aids that people blindly believed were as effective as that. Total Information Awareness too got restructured before anyone even blinked. COINTELPRO was not widely protested. DCSNet and FBI snarfing even less so.
  - hga 11y ago
    Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Federal_Aid_in_Wildlife_Restoration_Act https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede...). I think that's most because of the government's obviously ineffectual domestic response to 9/11 and Obama's indifference to all that and inimical attitudes towards us bitter clingers (I see no signs of a "180", just dishonesty in 2008), and e.g. Bush telling us our most important duty was to go shopping. But the post-9/11 expansions of the security state are a factor. It sure looked to me that the Church Committee et. al. had an effect for some years, and then there were great debates during the Clinton era over all this (remember the Clipper Chip?). At least they now feel a need to hide, there's a reason for that post-9/11. Mostly political, I suspect, but it might in part be due to feeling they won't have a secure rear area if they take this too far. People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard, and we have the numbers and the means to trivially swamp them. Fortunately for all concerned, just not the motivation. Yet, and for the foreseeable future. But we are most assuredly preparing. (And, please, no one handwave about drones et. al. Drone operators have to sleep some time at something resembling "home", there's a huge logistical tail, etc. Think also about scale, e.g. "Three Percent" of the absolute minimum 100 million gun owners in the country. And how we fight things like McCain-Feingold (Citizens United) that suppress our collective action; heck, while our betters are now trying to hide their surveillance efforts, they're quite open about frank abridgment of core political speech, which I find much more worrying.) And as long as I'm talking about dire subjects, it's long been my considered opinion that we won't get serious about all this until there are serious atrocities coming from less than robust and secure systems. Like a few thousand people dying from such a screwup, instead of the 3 from the Therac-25. I personally focus more on "robust" than "secure" (I noticed long before HN nickpsecurity's observation that there's no market for the latter, e.g. I was near ground zero for the final stages of the decline and fall of Multics), but they go hand in hand.

nickpsecurity 11y ago

"Nick, our programming ecosystem barely satisfies the basic principles of software fault tolerance, much less self-healing systems. High assurance? Multiple independent levels of security (MILS)? Covert channel resistance? Completely out of the question!" Original high assurance systems were done with Pascal, etc. Not much required in terms of programming past type and memory safety, esp strong interface checks. Plus easily understanding how that language becomes code with ability of compilers to transform it (eg auto-insertion of checks). More about a clear description of how it works, clear security policy, evidence they correspond, and implementation that maintains the same. As in another comment in this thread, small changes in hardware or OS's alone would create great increases in security. Far as the other requirements, software MILS just takes a microkernel with capabilities, periods processing, virtualizable hardware, and the right scheduler. A covert channel analysis via Kemmerer's Shared Resource Matrix can be done by a junior staffer with guidance and little time. That usable, prototypes of secure systems were done by small academic teams with 1990's and early 2000's tech shows it's well within reach of today's programmers. There's just an issue of willingness. Just look back at all the times I wrote up a secure-by-design system and how many people jumped on bandwagon to try to build their own. I can count them on my hands. "Yet one must not discount that how 0-days are even procured can involve questionable deeds." That's the subversion risk. The EAL6-7 development processes going back to Orange Book are designed to partly counter that. I add certified compilation, mutually suspicious parties doing analysis, diverse hardware, and so on in my requirements. Gotta address it all. Teams with little resources should focus on ability to detect, trace, and recover rather than prevent. Prevent what they can but only so much staff and time... "the property of domestic surveillance is not a unique event or something that can be eradicated, but a constant cyclical factor akin to a business cycle that may only be mitigated." That's an interesting thought. There have been cycles in my country. What worries me is the cyclical nature seems to be ending. We haven't seen the mass protests of police state activity that we wanted. The abuses revealed by Manning and Snowden led to griping followed largely by inaction. We've only seen American power increase even after the parties changed. The 180 of Obama administration on the key issues further suggests strong, covert influence that exists across parties and time. I wished we got something like Iceland in 2008 but America is a fake democracy: people did nothing, are mostly doing nothing, and TPP situation is set to confirm that trend. It's the new cycle.

vezzy-fnord 11y ago
The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure. Recursive restartability, microrebooting, state transfer to stable storage, event logs for fault recovery and piecewise determinism via replay of non-deterministic events, and many other hosts of options are all language-agnostic. Of course, many mission-critical projects will mandate redundancy through n-version programming where you have say a C implementation and Ada implementation of the same spec running concurrently with some failover scheme. Point is most of it is architectural and interface-related, not necessarily language-related. Hell, L4 was written in ASM at first. Since we can't get that, but instead mostly rely on cargo culting like "Haskell is magic pixie dust because math" for our software safety and availability, I find the prospects of careful HA research (which is more mathematically rigorous) to be daunting. Software MILS and separation kernels are promising, particularly what Muen does with the Intel VT-x extensions and its rather abundant configuration tools. Getting that deployed is going to be an uphill battle given fault tolerance's neglect, but also because many might perceive the static resource allocation to be anathema to "high scalability". I think you overestimate public resistance to surveillance. The Church Committee came and went quickly, and was forgotten and dismissed over the legislative band-aids that people blindly believed were as effective as that. Total Information Awareness too got restructured before anyone even blinked. COINTELPRO was not widely protested. DCSNet and FBI snarfing even less so.
- hga 11y ago
  Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Federal_Aid_in_Wildlife_Restoration_Act https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede...). I think that's most because of the government's obviously ineffectual domestic response to 9/11 and Obama's indifference to all that and inimical attitudes towards us bitter clingers (I see no signs of a "180", just dishonesty in 2008), and e.g. Bush telling us our most important duty was to go shopping. But the post-9/11 expansions of the security state are a factor. It sure looked to me that the Church Committee et. al. had an effect for some years, and then there were great debates during the Clinton era over all this (remember the Clipper Chip?). At least they now feel a need to hide, there's a reason for that post-9/11. Mostly political, I suspect, but it might in part be due to feeling they won't have a secure rear area if they take this too far. People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard, and we have the numbers and the means to trivially swamp them. Fortunately for all concerned, just not the motivation. Yet, and for the foreseeable future. But we are most assuredly preparing. (And, please, no one handwave about drones et. al. Drone operators have to sleep some time at something resembling "home", there's a huge logistical tail, etc. Think also about scale, e.g. "Three Percent" of the absolute minimum 100 million gun owners in the country. And how we fight things like McCain-Feingold (Citizens United) that suppress our collective action; heck, while our betters are now trying to hide their surveillance efforts, they're quite open about frank abridgment of core political speech, which I find much more worrying.) And as long as I'm talking about dire subjects, it's long been my considered opinion that we won't get serious about all this until there are serious atrocities coming from less than robust and secure systems. Like a few thousand people dying from such a screwup, instead of the 3 from the Therac-25. I personally focus more on "robust" than "secure" (I noticed long before HN nickpsecurity's observation that there's no market for the latter, e.g. I was near ground zero for the final stages of the decline and fall of Multics), but they go hand in hand.