4 ms·

Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were

by sqeaky 9y ago

Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were treated like their hardware it wouldn't be a problem.

rbanffy 9y ago
A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.
- sqeaky 9y ago
  A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
  - tw04 9y ago
    The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.
    - sqeaky 9y ago
      If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry I work making special purpose appliances right now, well maybe not right this second, clearly I am posting on HN, but I am at my desk where I should be writing software for one of these appliances. I am only describing exactly what my team is doing. We have a certification process too. I know exactly how painful it is. Bitching about the current and acting like it is immutable law won't fix it. Deciding on what "fixed" looks like then trying to change conditions to get there is one possible way to fix it. There are surely others but throwing our hands up and giving while making excuses isn't one of them.
      - tw04 9y ago
        >If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.
        sqeaky 9y ago
        We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.
  - rbanffy 9y ago
    The odds of getting it right are no better than any other OS with similar goals. We are not talking about a simple firmware, but something that'll run the software that controls a complicated machine, be it an MRI scanner or a nuclear power plant and that has to communicate with a myriad of sensors, actuators and other devices. Will you build it with virtual memory? Will processes have separate memory maps? Will they communicate via shared blocks? What kind of protocol and connections will be used for peripherals? I don't see that happening.
    - sqeaky 9y ago
      I agree with your assessment that one minimal is fundamentally better than a another newer one. I fail to see how replacing windows XP with a minimal can do anything other than result in an improvement.

by sqeaky 9y ago

rbanffy 9y ago

A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.

sqeaky 9y ago
A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
- tw04 9y ago
  The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.
  - sqeaky 9y ago
    If the certification disallowed extra garbage that would do it without a gun. > It's easy to sit back and cast judgement when you don't deal with that industry I work making special purpose appliances right now, well maybe not right this second, clearly I am posting on HN, but I am at my desk where I should be writing software for one of these appliances. I am only describing exactly what my team is doing. We have a certification process too. I know exactly how painful it is. Bitching about the current and acting like it is immutable law won't fix it. Deciding on what "fixed" looks like then trying to change conditions to get there is one possible way to fix it. There are surely others but throwing our hands up and giving while making excuses isn't one of them.
    - tw04 9y ago
      >If the certification disallowed extra garbage that would do it without a gun. So someone who has a device in them and lives for another 30 years is forced to undergo surgery in order to update to a newer version? And you SERIOUSLY think that's going to fly? I guess we can just agree to disagree.
      - sqeaky 9y ago
        We were talking about hospital infrastructure (but your example is worth discusing), I was not advocating re-certifying already deployed implants. Things like the software that runs MRI machines or stores medical records is buggy bloated crapware for the most part, and generally in need of whole replacement to stand a chance of resistant an actual attack. But your notion of how implants work is interesting. At present pacemaker batteries need to be replaced every 5 years (sometimes sooner if they stop responding by radio). Most pacemakers are only certified for 2 battery replacements. The situation you describe is actually much better than reality right now. Did you know there is a count of people who die to pacemaker bugs each year? Did you know that most pacemaker recipients have no right to see the software or pay to have an expert review the software in their pacemaker? I don't know what you think is going on in medicine now, but there is much that is deeply fucked up with it. Also your point is pretty ridiculous when you consider two points. We can do some updates to implants wirelessly and without surgery. Then consider that when regulations change there is often a subset of things that are grandfathered in from the old rules. There are still cars driving around with no seat belts and it is legal (in most places) because they were manufactured before seatbelt laws and maintained.
- rbanffy 9y ago
  The odds of getting it right are no better than any other OS with similar goals. We are not talking about a simple firmware, but something that'll run the software that controls a complicated machine, be it an MRI scanner or a nuclear power plant and that has to communicate with a myriad of sensors, actuators and other devices. Will you build it with virtual memory? Will processes have separate memory maps? Will they communicate via shared blocks? What kind of protocol and connections will be used for peripherals? I don't see that happening.
  - sqeaky 9y ago
    I agree with your assessment that one minimal is fundamentally better than a another newer one. I fail to see how replacing windows XP with a minimal can do anything other than result in an improvement.