3 ms·

Why don't you drive a different randomised route to and from work every day and keep a log of cars you keep recognising in the rear view mirror, to detect gover

Why don't you drive a different randomised route to and from work every day and keep a log of cars you keep recognising in the rear view mirror, to detect government/foreign intelligence spying on you? Or: why doesn't your car have an FIA compliant roll cage, a fire extinguishing system and six point harnesses? Same answer: for you (and 99.9% of us), the costs outweigh the benefits.

nickpsecurity 11y ago
The cost was nearly free for the basic protections. High-assurance design or components applied in otherwise commercial. We call this medium assurance but it's quite effective in practice. Even high-assurance projects like LOCK program said A1-class requirements only added around 30-40% to the cost of otherwise solid, development process. That's not bad for software that should rarely fail, get hacked, or be unrecoverable. I'd pay $150 for Windows instead of $100 or so. :) Meanwhile, methods like Cleanroom and Eiffel showed great reductions in defects and problems while around same cost and time to market due to reduced debugging. Sometimes faster or cheaper slightly. Sometimes slightly more cost or time. Not much of a difference and low technical debt meant it got cheaper to improve over time. So, your argument might apply if we're talking keeping legacy software at full speed on cheapest hardware with zero modifications. That really puts high-assurance in a box. Yet, if you're talking dramatically improving assurance of isolation or recovery at the least, then you can do it for a significant, but not heavy, additional cost. And remember much of those exorbitant costs came from straight-up inventing the stuff on the spot. Proven examples to draw from in the literature, including full designs, should drop that many fold. GEMSOS was $15 million over 2-5 years. seL4 was about $5 million over 2-4. A handful of academics put together Muen in SPARK pretty quickly so maybe a few hundred K to a million there. See how the costs drop as we do similar jobs with improved tools and prior examples?

nickpsecurity 11y ago

The cost was nearly free for the basic protections. High-assurance design or components applied in otherwise commercial. We call this medium assurance but it's quite effective in practice. Even high-assurance projects like LOCK program said A1-class requirements only added around 30-40% to the cost of otherwise solid, development process. That's not bad for software that should rarely fail, get hacked, or be unrecoverable. I'd pay $150 for Windows instead of $100 or so. :) Meanwhile, methods like Cleanroom and Eiffel showed great reductions in defects and problems while around same cost and time to market due to reduced debugging. Sometimes faster or cheaper slightly. Sometimes slightly more cost or time. Not much of a difference and low technical debt meant it got cheaper to improve over time. So, your argument might apply if we're talking keeping legacy software at full speed on cheapest hardware with zero modifications. That really puts high-assurance in a box. Yet, if you're talking dramatically improving assurance of isolation or recovery at the least, then you can do it for a significant, but not heavy, additional cost. And remember much of those exorbitant costs came from straight-up inventing the stuff on the spot. Proven examples to draw from in the literature, including full designs, should drop that many fold. GEMSOS was $15 million over 2-5 years. seL4 was about $5 million over 2-4. A handful of academics put together Muen in SPARK pretty quickly so maybe a few hundred K to a million there. See how the costs drop as we do similar jobs with improved tools and prior examples?