5 ms·

The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes

The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure. Recursive restartability, microrebooting, state transfer to stable storage, event logs for fault recovery and piecewise determinism via replay of non-deterministic events, and many other hosts of options are all language-agnostic. Of course, many mission-critical projects will mandate redundancy through n-version programming where you have say a C implementation and Ada implementation of the same spec running concurrently with some failover scheme. Point is most of it is architectural and interface-related, not necessarily language-related. Hell, L4 was written in ASM at first. Since we can't get that, but instead mostly rely on cargo culting like "Haskell is magic pixie dust because math" for our software safety and availability, I find the prospects of careful HA research (which is more mathematically rigorous) to be daunting. Software MILS and separation kernels are promising, particularly what Muen does with the Intel VT-x extensions and its rather abundant configuration tools. Getting that deployed is going to be an uphill battle given fault tolerance's neglect, but also because many might perceive the static resource allocation to be anathema to "high scalability". I think you overestimate public resistance to surveillance. The Church Committee came and went quickly, and was forgotten and dismissed over the legislative band-aids that people blindly believed were as effective as that. Total Information Awareness too got restructured before anyone even blinked. COINTELPRO was not widely protested. DCSNet and FBI snarfing even less so.

hga 11y ago
Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Federal_Aid_in_Wildlife_Restoration_Act https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede...). I think that's most because of the government's obviously ineffectual domestic response to 9/11 and Obama's indifference to all that and inimical attitudes towards us bitter clingers (I see no signs of a "180", just dishonesty in 2008), and e.g. Bush telling us our most important duty was to go shopping. But the post-9/11 expansions of the security state are a factor. It sure looked to me that the Church Committee et. al. had an effect for some years, and then there were great debates during the Clinton era over all this (remember the Clipper Chip?). At least they now feel a need to hide, there's a reason for that post-9/11. Mostly political, I suspect, but it might in part be due to feeling they won't have a secure rear area if they take this too far. People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard, and we have the numbers and the means to trivially swamp them. Fortunately for all concerned, just not the motivation. Yet, and for the foreseeable future. But we are most assuredly preparing. (And, please, no one handwave about drones et. al. Drone operators have to sleep some time at something resembling "home", there's a huge logistical tail, etc. Think also about scale, e.g. "Three Percent" of the absolute minimum 100 million gun owners in the country. And how we fight things like McCain-Feingold (Citizens United) that suppress our collective action; heck, while our betters are now trying to hide their surveillance efforts, they're quite open about frank abridgment of core political speech, which I find much more worrying.) And as long as I'm talking about dire subjects, it's long been my considered opinion that we won't get serious about all this until there are serious atrocities coming from less than robust and secure systems. Like a few thousand people dying from such a screwup, instead of the 3 from the Therac-25. I personally focus more on "robust" than "secure" (I noticed long before HN nickpsecurity's observation that there's no market for the latter, e.g. I was near ground zero for the final stages of the decline and fall of Multics), but they go hand in hand.
- vezzy-fnord 11y ago
  People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder. Rest assured your pipe dreams of "hang the bastards by their entrails" and mass slaughter will only let the samsara continue, as people who approve of killing anyone by association rather than by deed will quite likely reinstate the same authoritarian measures (or worse) themselves. I have noticed that you frequently engage in outlandish Second Amendment vengeance fantasies on this board quite frequently, though. If that's your fetish, so be it, but the fact is most Americans of that persuasion are not libertarian in the slightest, but interventionist theocrats. I'm not even sure what an "effectual domestic response to 9/11" would have been, other than do nothing, of course. That said, I do agree it will take some wanton death before fault tolerance becomes a concern. Certainly being armed is always a good precautionary measure, but avoidance of war is a prerogative and then if war commences, it must be directed and not carpet.
  - hga 11y ago
    Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder.... ...and then if war commences, it must be directed and not carpet.... "We don't care." As for "libertarian in the slightest, but interventionist theocrat", I have no idea what made you think I might be the former, nor am I the latter, nor are most of who I think the "Three Percent" might turn out to be the latter. Your mental model of me is, as far as I can tell, 90+% wrong.
    - vezzy-fnord 11y ago
      "We don't care" isn't a rebuttal, it's a trivial dismissal. I'm not sure who the "Three Percent" would be, then. That they are not interventionists and theocrats is reassuring to hear, but if their views support violating people's self-ownership of their bodies, their property and their civil liberties, then they are revolutionaries who I gravely fear.
nickpsecurity 11y ago
"The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure." I think you're going too far with it. Stuff like that is covered in fault-tolerant and immunity-aware computing. Most straight-forward approach is a NonStop-style system or TMR with voting. However, getting that far for fault-tolerance and security is way, way beyond standard practice. I'm just asking that standard practice move beyond the same old, same old problems. The baseline would be so much better and we could then work on the next leap. Not to mention the infusion of money and effort into tool support for that would greatly benefit high assurance work that tries to address what you're talking about. "ince we can't get that, but instead mostly rely on cargo culting like "Haskell is magic pixie dust because math" for our software safety and availability, I find the prospects of careful HA research (which is more mathematically rigorous) to be daunting." Best to think of it as several processes or systems working in lock-step one function or major state change at a time. That's been deployed in academia and commercially in many ways. There's even tools to draw on to help. Treating the system as a whole black box with restarts at failure simplifies things. This way, they can keep their pixie dust. Meanwhile, we make the pixie dust better. Memory-safety, type-safety, and concurrency safety by themselves knock out most of what does damage. Hardware enforcement of these for CPU and I/O interactions make attacker's job daunting. A great exception system will help, too. The next steps are Design-by-Contract, automated test generation from those specs, static analysis with no false positives, information flow labels a la Cornell's SIF/JIF, and continued use of cookbooks like OWASP tools. Combining the above leaves very little room for bugs to hide. At the least, attacks become so expensive and valuable that only nation-states have them. Progress, eh? ;) "Getting that deployed is going to be an uphill battle given fault tolerance's neglect" It's happening a lot in mobile and safety-critical embedded. Virtualization, esp security-centric, has already taken off. I think modifying one to work with cloud-stacks and piggybacking off them might help. Might drop it to medium assurance due to complexity but would be improvement. Can structure it and assure it like VAX VMM Security Kernel did with modern tools/analysis. I doubt we see mass market uptake but a niche market might pick it up if cost/benefit still looks good. "I think you overestimate public resistance to surveillance. The Church Committee came and went quickly, and was forgotten and dismissed over the legislative band-aids that people blindly believed were as effective as that." It was more about major abuses than surveillance. I have little faith in public on the latter. We at least got to see a lot of details on things like COINTELPRO that are important in countering the propaganda. Point was that action was taken, some kind of result happened, and their level of domestic abuse appeared to drop a bit. Another good example was increases of FOIA power at different points, which helped us many times in the past. We didn't really need major results from Snowden leaks to deal with NSA, etc. Might have been as simple as eliminating bulk, forcing FISA warrants for targeted collection on Americans (not collection criteria), ability to challenge that in court (no parallel construction), and a clear indicator that no company/individual can be compelled into backdoors. Just four points could go a long way to knock out biggest legal risk with private sector and nonprofits handling the rest. What we got instead was no response on... anything. I was less bummed about NSA than 2008 financial crisis. Over here, Wall St gets $1+ trillion, no questions asked, and immunity. Over in Iceland, they overthrew the corrupt machine, seized the assets, eliminated questionable debts, and (given Wikileaks was source) later passed some of best press protections in the world. That is how democracy is supposed to work when facing that level of corruption. The American approach was BOHICA: Bend Over, Here It Comes Again. Has been consistently since with few exceptions. Disgusting... I want to see Americans pull an Iceland on one of these core issues.

hga 11y ago

Maybe it's because we largely don't give a shit? One of the most notable reactions to 9/11 and then Obama's election and reign has been Americans arming themselves at astounding and unprecedented rates (something very well tracked because it's all taxed: https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Federal_Aid_in_Wildlife_Restoration_Act https://en.wikipedia.org/wiki/Pittman%E2%80%93Robertson_Fede...). I think that's most because of the government's obviously ineffectual domestic response to 9/11 and Obama's indifference to all that and inimical attitudes towards us bitter clingers (I see no signs of a "180", just dishonesty in 2008), and e.g. Bush telling us our most important duty was to go shopping. But the post-9/11 expansions of the security state are a factor. It sure looked to me that the Church Committee et. al. had an effect for some years, and then there were great debates during the Clinton era over all this (remember the Clipper Chip?). At least they now feel a need to hide, there's a reason for that post-9/11. Mostly political, I suspect, but it might in part be due to feeling they won't have a secure rear area if they take this too far. People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard, and we have the numbers and the means to trivially swamp them. Fortunately for all concerned, just not the motivation. Yet, and for the foreseeable future. But we are most assuredly preparing. (And, please, no one handwave about drones et. al. Drone operators have to sleep some time at something resembling "home", there's a huge logistical tail, etc. Think also about scale, e.g. "Three Percent" of the absolute minimum 100 million gun owners in the country. And how we fight things like McCain-Feingold (Citizens United) that suppress our collective action; heck, while our betters are now trying to hide their surveillance efforts, they're quite open about frank abridgment of core political speech, which I find much more worrying.) And as long as I'm talking about dire subjects, it's long been my considered opinion that we won't get serious about all this until there are serious atrocities coming from less than robust and secure systems. Like a few thousand people dying from such a screwup, instead of the 3 from the Therac-25. I personally focus more on "robust" than "secure" (I noticed long before HN nickpsecurity's observation that there's no market for the latter, e.g. I was near ground zero for the final stages of the decline and fall of Multics), but they go hand in hand.

vezzy-fnord 11y ago
People like me, at least, are willing to engage in mass slaughter of the organs of the state if they push too hard Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder. Rest assured your pipe dreams of "hang the bastards by their entrails" and mass slaughter will only let the samsara continue, as people who approve of killing anyone by association rather than by deed will quite likely reinstate the same authoritarian measures (or worse) themselves. I have noticed that you frequently engage in outlandish Second Amendment vengeance fantasies on this board quite frequently, though. If that's your fetish, so be it, but the fact is most Americans of that persuasion are not libertarian in the slightest, but interventionist theocrats. I'm not even sure what an "effectual domestic response to 9/11" would have been, other than do nothing, of course. That said, I do agree it will take some wanton death before fault tolerance becomes a concern. Certainly being armed is always a good precautionary measure, but avoidance of war is a prerogative and then if war commences, it must be directed and not carpet.
- hga 11y ago
  Violence is only permissible to defend property and retaliate against aggression, but it must be contained against the aggressors and not involve any collateral, for the latter would be unjust murder.... ...and then if war commences, it must be directed and not carpet.... "We don't care." As for "libertarian in the slightest, but interventionist theocrat", I have no idea what made you think I might be the former, nor am I the latter, nor are most of who I think the "Three Percent" might turn out to be the latter. Your mental model of me is, as far as I can tell, 90+% wrong.
  - vezzy-fnord 11y ago
    "We don't care" isn't a rebuttal, it's a trivial dismissal. I'm not sure who the "Three Percent" would be, then. That they are not interventionists and theocrats is reassuring to hear, but if their views support violating people's self-ownership of their bodies, their property and their civil liberties, then they are revolutionaries who I gravely fear.

nickpsecurity 11y ago

"The language's direct effect on fault tolerance is not always easily measurable. Even in C you could add compile-time instrumentation to discard invalid writes and redirect invalid reads to fixed-size buffers (failure-oblivious computing) and that's just a proactive measure." I think you're going too far with it. Stuff like that is covered in fault-tolerant and immunity-aware computing. Most straight-forward approach is a NonStop-style system or TMR with voting. However, getting that far for fault-tolerance and security is way, way beyond standard practice. I'm just asking that standard practice move beyond the same old, same old problems. The baseline would be so much better and we could then work on the next leap. Not to mention the infusion of money and effort into tool support for that would greatly benefit high assurance work that tries to address what you're talking about. "ince we can't get that, but instead mostly rely on cargo culting like "Haskell is magic pixie dust because math" for our software safety and availability, I find the prospects of careful HA research (which is more mathematically rigorous) to be daunting." Best to think of it as several processes or systems working in lock-step one function or major state change at a time. That's been deployed in academia and commercially in many ways. There's even tools to draw on to help. Treating the system as a whole black box with restarts at failure simplifies things. This way, they can keep their pixie dust. Meanwhile, we make the pixie dust better. Memory-safety, type-safety, and concurrency safety by themselves knock out most of what does damage. Hardware enforcement of these for CPU and I/O interactions make attacker's job daunting. A great exception system will help, too. The next steps are Design-by-Contract, automated test generation from those specs, static analysis with no false positives, information flow labels a la Cornell's SIF/JIF, and continued use of cookbooks like OWASP tools. Combining the above leaves very little room for bugs to hide. At the least, attacks become so expensive and valuable that only nation-states have them. Progress, eh? ;) "Getting that deployed is going to be an uphill battle given fault tolerance's neglect" It's happening a lot in mobile and safety-critical embedded. Virtualization, esp security-centric, has already taken off. I think modifying one to work with cloud-stacks and piggybacking off them might help. Might drop it to medium assurance due to complexity but would be improvement. Can structure it and assure it like VAX VMM Security Kernel did with modern tools/analysis. I doubt we see mass market uptake but a niche market might pick it up if cost/benefit still looks good. "I think you overestimate public resistance to surveillance. The Church Committee came and went quickly, and was forgotten and dismissed over the legislative band-aids that people blindly believed were as effective as that." It was more about major abuses than surveillance. I have little faith in public on the latter. We at least got to see a lot of details on things like COINTELPRO that are important in countering the propaganda. Point was that action was taken, some kind of result happened, and their level of domestic abuse appeared to drop a bit. Another good example was increases of FOIA power at different points, which helped us many times in the past. We didn't really need major results from Snowden leaks to deal with NSA, etc. Might have been as simple as eliminating bulk, forcing FISA warrants for targeted collection on Americans (not collection criteria), ability to challenge that in court (no parallel construction), and a clear indicator that no company/individual can be compelled into backdoors. Just four points could go a long way to knock out biggest legal risk with private sector and nonprofits handling the rest. What we got instead was no response on... anything. I was less bummed about NSA than 2008 financial crisis. Over here, Wall St gets $1+ trillion, no questions asked, and immunity. Over in Iceland, they overthrew the corrupt machine, seized the assets, eliminated questionable debts, and (given Wikileaks was source) later passed some of best press protections in the world. That is how democracy is supposed to work when facing that level of corruption. The American approach was BOHICA: Bend Over, Here It Comes Again. Has been consistently since with few exceptions. Disgusting... I want to see Americans pull an Iceland on one of these core issues.