5 ms·

I don't think you understand... there's literally 0 chance that hospitals and power plants are going to just universally enable windows update on their critical

by tw04 9y ago

I don't think you understand... there's literally 0 chance that hospitals and power plants are going to just universally enable windows update on their critical systems. Any patch that gets applied to life or death systems has to go through significant regression testing before going live. I guess you could suggest they just get universally redundant systems and take rolling outages, but I'm guessing nobody would be willing to pay for the cost of implementing such a scheme.

sqeaky 9y ago
Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were treated like their hardware it wouldn't be a problem.
- rbanffy 9y ago
  A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.
  - sqeaky 9y ago
    A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
    - tw04 9y ago
      The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.
      - sqeaky 9y ago
        If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry I work making special purpose appliances right now, well maybe not right this second, clearly I am posting on HN, but I am at my desk where I should be writing software for one of these appliances. I am only describing exactly what my team is doing. We have a certification process too. I know exactly how painful it is. Bitching about the current and acting like it is immutable law won't fix it. Deciding on what "fixed" looks like then trying to change conditions to get there is one possible way to fix it. There are surely others but throwing our hands up and giving while making excuses isn't one of them.
        tw04 9y ago
        >If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.
        sqeaky 9y ago
        We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.
    - rbanffy 9y ago
      The odds of getting it right are no better than any other OS with similar goals. We are not talking about a simple firmware, but something that'll run the software that controls a complicated machine, be it an MRI scanner or a nuclear power plant and that has to communicate with a myriad of sensors, actuators and other devices. Will you build it with virtual memory? Will processes have separate memory maps? Will they communicate via shared blocks? What kind of protocol and connections will be used for peripherals? I don't see that happening.
      - sqeaky 9y ago
        I agree with your assessment that one minimal is fundamentally better than a another newer one. I fail to see how replacing windows XP with a minimal can do anything other than result in an improvement.
bluGill 9y ago
If someone is attacking our infrastructure often they will do SOMETHING. I don't know what, but they have no choice. There has been enough ransomware this year that anyone who fell victim is criminally negligent. There are lots of ways to prevent this attack: more frequent backups, more frequent updates, and physical disconnection of the systems (probably more). All of the above should be there in some form anyway. This will probably mean hospitals and the FDA get much stricter about what is allowed on medical devices. You cannot update because of risk: that means you can only have certified software. Microsoft will not like being told they are not allowed in hospitals and in turn will be more secure. It is a race, and whoever is doing this is showing their cards early which gives everybody time to fix things. (I will not claim this there is enough time)
- tw04 9y ago
  Microsoft can't get "more secure". The issue isn't Microsoft, it's the fact that we now live in a world where exploits get publicly released in a time frame that no device manufacturer can possibly keep up with while adhering to fda regulations. Do you want stable or fast? You aren't getting both.
  - bluGill 9y ago
    Perfection is impossible, but OpenBSD shows that you can get close: only two exploitable holes is a good track record. Now granted there is a lot of fine print in there (the big one being you need to be up to date - many of the holes people are falling victim to Microsoft has already fixed). OpenBSD puts a large amount of effort into their code audits to achieve that, which is expensive. Microsoft probably will be willing to give devices completely instead of going that far.
    - tw04 9y ago
      And how many third party devices are supported under OpenBSD? What does their ecosystem look like? It's easy to have a "secure track record" when you say no to 90% of the outside code contributions and support a minimal amount of hardware. There's basically 0 chance that OpenBSD would ever be the source of medical devices.

by tw04 9y ago

sqeaky 9y ago

Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were treated like their hardware it wouldn't be a problem.

rbanffy 9y ago
A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.
- sqeaky 9y ago
  A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
  - tw04 9y ago
    The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.
    - sqeaky 9y ago
      If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry I work making special purpose appliances right now, well maybe not right this second, clearly I am posting on HN, but I am at my desk where I should be writing software for one of these appliances. I am only describing exactly what my team is doing. We have a certification process too. I know exactly how painful it is. Bitching about the current and acting like it is immutable law won't fix it. Deciding on what "fixed" looks like then trying to change conditions to get there is one possible way to fix it. There are surely others but throwing our hands up and giving while making excuses isn't one of them.
      - tw04 9y ago
        >If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.
        sqeaky 9y ago
        We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.
  - rbanffy 9y ago
    The odds of getting it right are no better than any other OS with similar goals. We are not talking about a simple firmware, but something that'll run the software that controls a complicated machine, be it an MRI scanner or a nuclear power plant and that has to communicate with a myriad of sensors, actuators and other devices. Will you build it with virtual memory? Will processes have separate memory maps? Will they communicate via shared blocks? What kind of protocol and connections will be used for peripherals? I don't see that happening.
    - sqeaky 9y ago
      I agree with your assessment that one minimal is fundamentally better than a another newer one. I fail to see how replacing windows XP with a minimal can do anything other than result in an improvement.

bluGill 9y ago

If someone is attacking our infrastructure often they will do SOMETHING. I don't know what, but they have no choice. There has been enough ransomware this year that anyone who fell victim is criminally negligent. There are lots of ways to prevent this attack: more frequent backups, more frequent updates, and physical disconnection of the systems (probably more). All of the above should be there in some form anyway. This will probably mean hospitals and the FDA get much stricter about what is allowed on medical devices. You cannot update because of risk: that means you can only have certified software. Microsoft will not like being told they are not allowed in hospitals and in turn will be more secure. It is a race, and whoever is doing this is showing their cards early which gives everybody time to fix things. (I will not claim this there is enough time)

tw04 9y ago
Microsoft can't get "more secure". The issue isn't Microsoft, it's the fact that we now live in a world where exploits get publicly released in a time frame that no device manufacturer can possibly keep up with while adhering to fda regulations. Do you want stable or fast? You aren't getting both.
- bluGill 9y ago
  Perfection is impossible, but OpenBSD shows that you can get close: only two exploitable holes is a good track record. Now granted there is a lot of fine print in there (the big one being you need to be up to date - many of the holes people are falling victim to Microsoft has already fixed). OpenBSD puts a large amount of effort into their code audits to achieve that, which is expensive. Microsoft probably will be willing to give devices completely instead of going that far.
  - tw04 9y ago
    And how many third party devices are supported under OpenBSD? What does their ecosystem look like? It's easy to have a "secure track record" when you say no to 90% of the outside code contributions and support a minimal amount of hardware. There's basically 0 chance that OpenBSD would ever be the source of medical devices.