4 ms·

"Anticipating your questions: not even the slightest smell of Linux. All the popular operating systems aren’t designed with security in mind, so it’s simpler an

"Anticipating your questions: not even the slightest smell of Linux. All the popular operating systems aren’t designed with security in mind, so it’s simpler and safer to start from the ground up and do everything correctly." It looks like a realistic assessment. General purpose operating systems ( at least the 3 most famous ones ) are built with ease of use in mind, not security. Even Torvalds admits it, saying that he sees performance as a top priority, and not security. If Kaspersky OS is more secure or not, we will see in the future.

hobarrera 10y ago
OpenBSD is pretty popular in the security community, and is as FLOSS as it gets.
- vbezhenar 10y ago
  Yet it's not widely used as embedded OS. I never saw any router with OpenBSD or web camera. The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. Also it's not clear how many vulnerabilities, used in real life attacks (like DDOS from IoT devices) are in latest Linux kernel? May be problem not with Linux, but with custom software or lack of updates.
  - MichaelBurge 10y ago
    These two statements contradict each other: > The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. > This unassuming black box is [...] designed for networks with extreme requirements for data security. You can claim that nobody will buy Kaspersky's device, or that they did poor market research. But you can't claim that they don't care about security.
    - vbezhenar 10y ago
      Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).
      - nickpsecurity 10y ago
        "Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by expert breakers. We should by default think they don't know what they're doing and the product is insecure until proven otherwise. Like always. People often mistake "company in security industry selling security products" with "knows how to secure software or systems." They're two very different things.
        MichaelBurge 10y ago
        Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence. If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.
        nickpsecurity 10y ago
        There's little to no liability in most situations. Security experts have been pushing for liability for a long time as a solution to this. Basically, we want a minimum level of responsibility like what exists in safety-critical industries. Schneier has a brief essay that explains it well: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
    - mfukar 10y ago
      You can care about security and still make totally wrong decisions.
  - shubb 10y ago
    The thing with a BSD project is that it is a kernel, a distribution of slightly modified and configured 3rd party applications, and a bunch of 1st party applications. OpenBSD project includes stuff like OpenSSH, time sync tools, an SSL implementation, and these are very widely used. Are those devices OpenBSD based though? Similarly with BSD code, you can just use it and you only need to credit it with the code, so lots of OpenBSD kernel code will be in other systems with no user visible attribution. If MacOS kernel contains OpenBSD code, even big chunks, is it OpenBSD based? With Linux, GPL means its kind of visible when someone is using it, and GPL encourages you not to integrate your software with it too tightly, so you get an obviously Linux based device with proprietary code on the top. With BSD, you can integrate much more tightly, only ever need to give out a binary blob, and no one would know you were using it. That said, OpenBSD is kind of server oriented, and FreeBSD would be a more popular starting point for a device, but you might well crib OpenBSD for best practices.
  - rthomas6 10y ago
    But OSX, Windows, and full-blown Linux aren't used as embedded OSes either. Linux is a bit, but there are a lot of other choices.
    - linkregister 10y ago
      I'm not sure if it shares APIs with Win32, but Windows CE runs almost half of every ATM I've ever used.
      - diegoperini 10y ago
        Also cash machines.
        pbhjpbhj 10y ago
        ATM (Automatic Telling Machine) is American English for a cash machine. A teller is a bank worker who handles cash.
        fdgdasfadsf 10y ago
        It's UK English too. But not as common as cash machine/cash point/hole in the wall.
      - wongarsu 10y ago
        The other half seems to be powered by Windows XP.
    - notalaser 10y ago
      "A bit" is an understatement. The vast majority of non-server deployments of Linux are embedded systems, and embedded systems requirements are one of the most important driving factors in its development nowadays.
  - nickpsecurity 10y ago
    This defense contractor builds their stuff on OpenBSD: https://www.genua.de/en/solutions.html https://www.genua.de/en/solutions.html One can always strip out what's not necessary. One can also put it in user-mode on top of a secure microkernel with some services running directly on microkernel and some running in OpenBSD. That Kaspersky thought the choices were Linux-based or purely clean-slate shows limited knowledge of what's out there or a personal preference.
    - wongarsu 10y ago
      I it's more likely that Kaspersky lumped OpenBSD and Linux together as Unix-likes (very valid since they are talking about basic OS architecture choices in that section), and chose to say Linux instead of Unix-like because Linux is much more widely known.
      - nickpsecurity 10y ago
        It's possible but I'm not saying likely. OpenBSD's handling of UNIX architecture, low-level primitives, security features, and code quality stand out a lot. It's still UNIX-like enough to have UNIX weaknesses but they mitigate quite a bit. Kaspersky has a big-enough ego that I suspect his main goal is just having one of his company's and country's own to brag about. Especially if it ends up better in track record than something like Linux that's very visible albeit not made for security. That will actually be straight-forward if it's a Layer 2 or 3 operating system given how little they need to get right with one.
- this-dang-guy 10y ago
  Yes, my first thought (after VMS) when he said no popular OS is designed for security. Then of course, I realized that by "Popular" he meant Mac OSX, Windows, and Linux. Linux of course, we all know is a security mess because Torvalds refuses to deal with security issues.
  - busterarm 10y ago
    I don't think it's a fair statement to blame Linux's security problems on Linus. Linux provides support for lots of security options, but the project's guiding philosophy is "don't break userland". This is 99% of the time what you see Linus cursing out other kernel contributors for. All of the possible options that Linus could _enforce_ would do just that. Heck, a lot of the security problems and blame have nothing to do with the kernel at all and lie squarely with systemd and how it's implemented. If these are dealbreaker features that you must have, Linux is not the tool for you. Your efforts are better spent working to improve OpenBSD.
    - this-dang-guy 10y ago
      Sure, but comments like: "Security people are often the black-and-white kind of people that I can't stand. I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them." "So LSM stays in. No ifs, buts, maybes or anything else. When I see the security people making sane arguments and agreeing on something, that will change. Quite frankly, I expect hell to freeze over before that happens, and pigs will be nesting in trees. But hey, I can hope." He's typically very critical of security-related changes unless they are a massive improvement. I think characterizing him as "functionality over security" is entirely fair. He's not even wrong necessarily.
      - busterarm 10y ago
        The market has sort of proved him right. Companies that use Linux and need security will either get caught with their pants down or they won't. It's up to their level of preparedness and luck. I wouldn't underwrite that if I were an insurer though. Those of us that care are already using something else.
hawski 10y ago
Which is funny, because they say that popular operating systems are not designed with security in mind. They give this as a reason to start from the ground up. I am from the camp saying that currently sole kernel does not an OS make. With this in mind network equipment OSes are certainly not popular ones. Nevertheless there are probably lots of less popular OSes with less popular kernels that are designed with security in mind. Some of them are probably good tries at such a goal. They could be used and extended and it would be probably better securitywise, because of years of bug fixes, that no new OS can have.
- nickpsecurity 10y ago
  To support your point, the company below did a clean-slate OS tightly integrated with hardware protection features of Itanium CPU's to give people hell trying to compromise their DNS servers. Also re-did the networking stack to assume a hostile instead of benign network. Way over due there. The OS is available for licensing IIRC but OEM's don't give a shit about security if dollars are on the line. ;) http://www.secure64.com/secure-operating-system http://www.secure64.com/secure-operating-system An older one that was pentested by the NSA with positive results reduced attack surface by using PPC embedded board, INTEGRITY microkernel, and carefully-coded state machines. That a small team made this shows both the big companies and startups could be doing way better if they cared. http://www.sentinelsecurity.us/HYDRA/hydra.html http://www.sentinelsecurity.us/HYDRA/hydra.html

hobarrera 10y ago

OpenBSD is pretty popular in the security community, and is as FLOSS as it gets.

vbezhenar 10y ago
Yet it's not widely used as embedded OS. I never saw any router with OpenBSD or web camera. The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. Also it's not clear how many vulnerabilities, used in real life attacks (like DDOS from IoT devices) are in latest Linux kernel? May be problem not with Linux, but with custom software or lack of updates.
- MichaelBurge 10y ago
  These two statements contradict each other: > The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. > This unassuming black box is [...] designed for networks with extreme requirements for data security. You can claim that nobody will buy Kaspersky's device, or that they did poor market research. But you can't claim that they don't care about security.
  - vbezhenar 10y ago
    Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).
    - nickpsecurity 10y ago
      "Kaspersky certainly care about security, it's their business." Their business is selling antivirus & other software, not security. They have no history whatsoever of building a piece of software immune to code injection by determined attackers. There are companies and academics that build stuff like that. Some were evaluated by pentesters of third parties. Kaspersky has neither that background nor evaluations by expert breakers. We should by default think they don't know what they're doing and the product is insecure until proven otherwise. Like always. People often mistake "company in security industry selling security products" with "knows how to secure software or systems." They're two very different things.
      - MichaelBurge 10y ago
        Can't you sue a company selling security products if it ends up being insecure? This is different from ordinary software, because most ordinary software isn't marketed with security as its primary selling feature. And if they're not getting it tested by independent experts, that could be negligence. If they're not liable in any way, then I agree it's nothing more than marketing to call it secure.
        nickpsecurity 10y ago
        There's little to no liability in most situations. Security experts have been pushing for liability for a long time as a solution to this. Basically, we want a minimum level of responsibility like what exists in safety-critical industries. Schneier has a brief essay that explains it well: https://www.schneier.com/blog/archives/2004/11/computer_securi.html https://www.schneier.com/blog/archives/2004/11/computer_secu...
  - mfukar 10y ago
    You can care about security and still make totally wrong decisions.
- shubb 10y ago
  The thing with a BSD project is that it is a kernel, a distribution of slightly modified and configured 3rd party applications, and a bunch of 1st party applications. OpenBSD project includes stuff like OpenSSH, time sync tools, an SSL implementation, and these are very widely used. Are those devices OpenBSD based though? Similarly with BSD code, you can just use it and you only need to credit it with the code, so lots of OpenBSD kernel code will be in other systems with no user visible attribution. If MacOS kernel contains OpenBSD code, even big chunks, is it OpenBSD based? With Linux, GPL means its kind of visible when someone is using it, and GPL encourages you not to integrate your software with it too tightly, so you get an obviously Linux based device with proprietary code on the top. With BSD, you can integrate much more tightly, only ever need to give out a binary blob, and no one would know you were using it. That said, OpenBSD is kind of server oriented, and FreeBSD would be a more popular starting point for a device, but you might well crib OpenBSD for best practices.
- rthomas6 10y ago
  But OSX, Windows, and full-blown Linux aren't used as embedded OSes either. Linux is a bit, but there are a lot of other choices.
  - linkregister 10y ago
    I'm not sure if it shares APIs with Win32, but Windows CE runs almost half of every ATM I've ever used.
    - diegoperini 10y ago
      Also cash machines.
      - pbhjpbhj 10y ago
        ATM (Automatic Telling Machine) is American English for a cash machine. A teller is a bank worker who handles cash.
        fdgdasfadsf 10y ago
        It's UK English too. But not as common as cash machine/cash point/hole in the wall.
    - wongarsu 10y ago
      The other half seems to be powered by Windows XP.
  - notalaser 10y ago
    "A bit" is an understatement. The vast majority of non-server deployments of Linux are embedded systems, and embedded systems requirements are one of the most important driving factors in its development nowadays.
- nickpsecurity 10y ago
  This defense contractor builds their stuff on OpenBSD: https://www.genua.de/en/solutions.html https://www.genua.de/en/solutions.html One can always strip out what's not necessary. One can also put it in user-mode on top of a secure microkernel with some services running directly on microkernel and some running in OpenBSD. That Kaspersky thought the choices were Linux-based or purely clean-slate shows limited knowledge of what's out there or a personal preference.
  - wongarsu 10y ago
    I it's more likely that Kaspersky lumped OpenBSD and Linux together as Unix-likes (very valid since they are talking about basic OS architecture choices in that section), and chose to say Linux instead of Unix-like because Linux is much more widely known.
    - nickpsecurity 10y ago
      It's possible but I'm not saying likely. OpenBSD's handling of UNIX architecture, low-level primitives, security features, and code quality stand out a lot. It's still UNIX-like enough to have UNIX weaknesses but they mitigate quite a bit. Kaspersky has a big-enough ego that I suspect his main goal is just having one of his company's and country's own to brag about. Especially if it ends up better in track record than something like Linux that's very visible albeit not made for security. That will actually be straight-forward if it's a Layer 2 or 3 operating system given how little they need to get right with one.
this-dang-guy 10y ago
Yes, my first thought (after VMS) when he said no popular OS is designed for security. Then of course, I realized that by "Popular" he meant Mac OSX, Windows, and Linux. Linux of course, we all know is a security mess because Torvalds refuses to deal with security issues.
- busterarm 10y ago
  I don't think it's a fair statement to blame Linux's security problems on Linus. Linux provides support for lots of security options, but the project's guiding philosophy is "don't break userland". This is 99% of the time what you see Linus cursing out other kernel contributors for. All of the possible options that Linus could _enforce_ would do just that. Heck, a lot of the security problems and blame have nothing to do with the kernel at all and lie squarely with systemd and how it's implemented. If these are dealbreaker features that you must have, Linux is not the tool for you. Your efforts are better spent working to improve OpenBSD.
  - this-dang-guy 10y ago
    Sure, but comments like: "Security people are often the black-and-white kind of people that I can't stand. I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them." "So LSM stays in. No ifs, buts, maybes or anything else. When I see the security people making sane arguments and agreeing on something, that will change. Quite frankly, I expect hell to freeze over before that happens, and pigs will be nesting in trees. But hey, I can hope." He's typically very critical of security-related changes unless they are a massive improvement. I think characterizing him as "functionality over security" is entirely fair. He's not even wrong necessarily.
    - busterarm 10y ago
      The market has sort of proved him right. Companies that use Linux and need security will either get caught with their pants down or they won't. It's up to their level of preparedness and luck. I wouldn't underwrite that if I were an insurer though. Those of us that care are already using something else.

hawski 10y ago

Which is funny, because they say that popular operating systems are not designed with security in mind. They give this as a reason to start from the ground up. I am from the camp saying that currently sole kernel does not an OS make. With this in mind network equipment OSes are certainly not popular ones. Nevertheless there are probably lots of less popular OSes with less popular kernels that are designed with security in mind. Some of them are probably good tries at such a goal. They could be used and extended and it would be probably better securitywise, because of years of bug fixes, that no new OS can have.

nickpsecurity 10y ago
To support your point, the company below did a clean-slate OS tightly integrated with hardware protection features of Itanium CPU's to give people hell trying to compromise their DNS servers. Also re-did the networking stack to assume a hostile instead of benign network. Way over due there. The OS is available for licensing IIRC but OEM's don't give a shit about security if dollars are on the line. ;) http://www.secure64.com/secure-operating-system http://www.secure64.com/secure-operating-system An older one that was pentested by the NSA with positive results reduced attack surface by using PPC embedded board, INTEGRITY microkernel, and carefully-coded state machines. That a small team made this shows both the big companies and startups could be doing way better if they cared. http://www.sentinelsecurity.us/HYDRA/hydra.html http://www.sentinelsecurity.us/HYDRA/hydra.html