4 ms·

The author of the presentation lost my respect when I read he is advocating for using SELinux and Linux containers instead of zones and SmartOS, which tells me

by Annatar 11y ago

The author of the presentation lost my respect when I read he is advocating for using SELinux and Linux containers instead of zones and SmartOS, which tells me he is not up to date on security. The whole thing was even made worse by him advocating for the use of continous integration: no, .tar files and Docker images are not the same thing as operating system packages, nor do they come anywhere near the functionality, therefore "DevOps" is insane, especially when the whole thing can be pulled off correctly and securely with SmartOS zones, OS packaging for both delivery and configuration management, and change management process modeling. Those are your airbags, crumple zones, and safety systems, not SELinux, "DevOps", nor Linux "containers". The only thing of technical value in the presentation is how to put SSH keys on SmartCards, and even that is just explained as a series of manual steps (hacking in system engineering context), rather than as a turnkey, OS packaging process (full, high quality, repeatable integration). Damn it how I loathe half-baked stuff from people who should know better but don't: if you are going to be presenting on security, you better know what you are talking about, or else it is blind leading the blind.

akulbe 11y ago
My apologies, but your entire comment reads like this: "They are dumb, because they don't do it how I would do it. I know better. They are so stupid." I'm not a security professional by any means, but I'm interested in learning how to do stuff better. Can you please reframe your response with solutions, and not snark?
- Annatar 11y ago
  > Can you please reframe your response with solutions, and not snark? Hardly, as it would require writing a book. But, what I can do is give you some starting points: https://wiki.smartos.org/display/DOC/Home https://wiki.smartos.org/display/DOC/Home Set up a TFTP server, a DHCP server, and use PXEGrub (ipxe is flaky). Boot the system off of the network. As soon as you log in, read the manual pages for imgadm(1M), and vmadm(1M), then pull down the "base64" image. Also read up on Solaris zones. Oracle documentation will do, as SmartOS and Solaris 10 are similar to a good degree. Next, read up on pkgsrc, and make a simple "helloworld" package. After you get all that working, get Gemalto SmartCard code working on SmartOS (as Solaris was a big market for SmartCards, the code should still work on SmartOS). > "They are dumb, because they don't do it how I would do it. I know better. To summarize: if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives.
  - acdha 11y ago
    > if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives. That's a very bold assertion and you haven't even tried to back it up. Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? You really need to back that claim up and do so comprehensively across the entire security landscape from basic design to operational concerns like patch management. (As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I'm open to the argument that they're all paranoid or incompetent but that's probably the most important real world security task and it at least merits discussion)
    - Annatar 11y ago
      > Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? That depends on one's experience level, to have the requisite experience to recognize a solution which one should do one's homework on, when someone mentions it, and so will anyone else who has been doing this kind of work long enough. For example, the NSA has been both using and modifying (Open)Solaris for decades now; you can find their papers on securing it with IPsec and locking the OS down, as they've been released to the public. They are still relevant, both in illumos / SmartOS and security context today. Now with virtualization, cloud and containers, moreso than ever. NSA was prescient, or at the very least had common sense. Apropos Google, Facebook, trendy... two things: "if a hundred million flies all eat shit, surely they can't be wrong?" I've been doing this container, virtualization and UNIX long before Facebook and Google even got the idea, even before those companies existed (;-) When you dedicate every waking moment of your life to studying and mastering UNIX, not only professionally but privately, in time you obtain the insights needed to understand and evaluate what is and isn't good technology. Put enough priority 1 incidents and sleepless nights behind you, and you will know what works, and what doesn't. As Paul Graham so aptly put it, "When you choose technology, you have to ignore what other people are doing, and consider only what will work the best." http://www.paulgraham.com/avg.html http://www.paulgraham.com/avg.html
tyingq 11y ago
You may be right, but from my perspective you're falling into the same trap that most IT security people do. You're assuming that the mainstream devs should put security first. They just never will. Follow the money. The money is paying for revenue generating activity. Using your example that "zones and SmartOS" are preferable to "SELinux and Linux Containers"....that's not going to happen. The people with the money have already chosen the container direction. A much better strategy would be to give up on what you want, and focus your energy on making the direction that's been chosen more secure. I suspect if enough talented, security minded engineers descended as contributors for docker, rkt, etc...the situation would improve much faster than the current direction of just complaining they aren't secure. Perfect is the enemy of good.
- Annatar 11y ago
  > Using your example that "zones and SmartOS" are preferable to "SELinux and Linux Containers"....that's not going to happen. That has actually already taken place, and is taking place. There is unlikely to be one winner-take-all. Following the money does not mean that the application cannot be programmed from the ground up to support SmartCards and roles, or that it has to be full of security holes. > I suspect if enough talented, security minded engineers descended as contributors for docker, rkt, etc. Depends on what is under etcetera. Docker and rkt are not the Silver bullets everyone who has not gotten busted by them think they are, they are just a trend. With all of those you instantenously lose lifecycle management, because they are just images of massive file dumps, not images of software and configuration installed with packages. When you use Solaris zones in SmartOS, Docker and rkt become completely superfluous, because you suddenly get a fully working yet completely isolated UNIX server, running at the speed of bare metal no less. Add some OS packages on top of that, make them into an image for imgadm(1M), and in few seconds you're done. What does one need Docker for in that scenario? And I should certainly hope that perfect is the enemy of good, because life has taught me, the hard way, that good isn't good enough. I absolutely hate being woken up during the night because of an incident, and will go out of my way to get as close to perfect as possible in order to be able to sleep through the night.
  - tyingq 11y ago

by Annatar 11y ago

akulbe 11y ago

My apologies, but your entire comment reads like this: "They are dumb, because they don't do it how I would do it. I know better. They are so stupid." I'm not a security professional by any means, but I'm interested in learning how to do stuff better. Can you please reframe your response with solutions, and not snark?

Annatar 11y ago
> Can you please reframe your response with solutions, and not snark? Hardly, as it would require writing a book. But, what I can do is give you some starting points: https://wiki.smartos.org/display/DOC/Home https://wiki.smartos.org/display/DOC/Home Set up a TFTP server, a DHCP server, and use PXEGrub (ipxe is flaky). Boot the system off of the network. As soon as you log in, read the manual pages for imgadm(1M), and vmadm(1M), then pull down the "base64" image. Also read up on Solaris zones. Oracle documentation will do, as SmartOS and Solaris 10 are similar to a good degree. Next, read up on pkgsrc, and make a simple "helloworld" package. After you get all that working, get Gemalto SmartCard code working on SmartOS (as Solaris was a big market for SmartCards, the code should still work on SmartOS). > "They are dumb, because they don't do it how I would do it. I know better. To summarize: if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives.
- acdha 11y ago
  > if you want security, you have no business running Linux-anything, not now, not ever: the choices are either OpenBSD or SmartOS, and rejoice that we do have alternatives. That's a very bold assertion and you haven't even tried to back it up. Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? You really need to back that claim up and do so comprehensively across the entire security landscape from basic design to operational concerns like patch management. (As an example: I've never logged into a Solaris / Illumos machine which was current on security updates because the admins didn't have the confidence which Debian admins have had since the 90s that updates won't break things. I'm open to the argument that they're all paranoid or incompetent but that's probably the most important real world security task and it at least merits discussion)
  - Annatar 11y ago
    > Who do you think is going to read that and say “some random Internet commenter is right and Google/Facebook/the NSA/etc. must all be incompetent”? That depends on one's experience level, to have the requisite experience to recognize a solution which one should do one's homework on, when someone mentions it, and so will anyone else who has been doing this kind of work long enough. For example, the NSA has been both using and modifying (Open)Solaris for decades now; you can find their papers on securing it with IPsec and locking the OS down, as they've been released to the public. They are still relevant, both in illumos / SmartOS and security context today. Now with virtualization, cloud and containers, moreso than ever. NSA was prescient, or at the very least had common sense. Apropos Google, Facebook, trendy... two things: "if a hundred million flies all eat shit, surely they can't be wrong?" I've been doing this container, virtualization and UNIX long before Facebook and Google even got the idea, even before those companies existed (;-) When you dedicate every waking moment of your life to studying and mastering UNIX, not only professionally but privately, in time you obtain the insights needed to understand and evaluate what is and isn't good technology. Put enough priority 1 incidents and sleepless nights behind you, and you will know what works, and what doesn't. As Paul Graham so aptly put it, "When you choose technology, you have to ignore what other people are doing, and consider only what will work the best." http://www.paulgraham.com/avg.html http://www.paulgraham.com/avg.html

tyingq 11y ago

You may be right, but from my perspective you're falling into the same trap that most IT security people do. You're assuming that the mainstream devs should put security first. They just never will. Follow the money. The money is paying for revenue generating activity. Using your example that "zones and SmartOS" are preferable to "SELinux and Linux Containers"....that's not going to happen. The people with the money have already chosen the container direction. A much better strategy would be to give up on what you want, and focus your energy on making the direction that's been chosen more secure. I suspect if enough talented, security minded engineers descended as contributors for docker, rkt, etc...the situation would improve much faster than the current direction of just complaining they aren't secure. Perfect is the enemy of good.

Annatar 11y ago
> Using your example that "zones and SmartOS" are preferable to "SELinux and Linux Containers"....that's not going to happen. That has actually already taken place, and is taking place. There is unlikely to be one winner-take-all. Following the money does not mean that the application cannot be programmed from the ground up to support SmartCards and roles, or that it has to be full of security holes. > I suspect if enough talented, security minded engineers descended as contributors for docker, rkt, etc. Depends on what is under etcetera. Docker and rkt are not the Silver bullets everyone who has not gotten busted by them think they are, they are just a trend. With all of those you instantenously lose lifecycle management, because they are just images of massive file dumps, not images of software and configuration installed with packages. When you use Solaris zones in SmartOS, Docker and rkt become completely superfluous, because you suddenly get a fully working yet completely isolated UNIX server, running at the speed of bare metal no less. Add some OS packages on top of that, make them into an image for imgadm(1M), and in few seconds you're done. What does one need Docker for in that scenario? And I should certainly hope that perfect is the enemy of good, because life has taught me, the hard way, that good isn't good enough. I absolutely hate being woken up during the night because of an incident, and will go out of my way to get as close to perfect as possible in order to be able to sleep through the night.
- tyingq 11y ago