5 ms·

Yes, but virtualization does seem to have a lot of security benefits. Theo using lots of clever words to call someone stupid isn't a refutation of this. Even i

Yes, but virtualization does seem to have a lot of security benefits. Theo using lots of clever words to call someone stupid isn't a refutation of this. Even if both layers have holes, the fact that there's more than one layer does, in fact, suggest the composition is more secure.

jstewartmobile 9y ago
I respect Rutkowska. That being said, I also think she's putting a band-aid on a festering sore most people call the PC architecture. Security guys have been going on about "defense-in-depth" for decades, and it all still looks like a trash fire to me. From a systems perspective, you don't make things more robust by adding more layers that can break. You do it by simplifying it down to something manageable, then managing it. You call it a security layer. I call it an extra attack surface.
- jerheinze 9y ago
  Using your own reasoning one would end up with absurd conclusions such as that sandboxing shouldn't be added, "You call it a security layer. I call it an extra attack surface." Therefore your reasoning is fallacious.
  - jstewartmobile 9y ago
    My reasoning is no more fallacious than your reading comprehension. If sandboxing is necessary to make things manageable, it should be baked-in rather than being yet another moving layer inserted into the hundreds we already have. The combinatorics of PC development/security/maintenance/etc are ridiculous enough as it is.
    - jerheinze 9y ago
      You're still missing the point which is that it doesn't make it less secure (which is what you claimed), in fact, it makes it more secure.
- jnwatson 9y ago
  Rutkowsja herself has done more to expose the broken bits of x86 than probably anyone else. Remember blue pill? That was her. Also important work in SMM and Intel TXT. I'd say she is well aware of the limitations of her product.
  - jstewartmobile 9y ago
    Nothing but respect for Rutkowska. Still think x86 and PC architecture are the kinds of abomination that should be cleansed with fire.
    - mi100hael 9y ago
      So your security solution is to just quit using computers?
      - jstewartmobile 9y ago
        Look into the many different architectures developed from the 60s all the way up to the early 80s. B5000, Symbolics, Alto, VAX, Connection Machine, etc... There are so many ways to go about it, and we really chose the wrong door. Even back in the 70s, guys like Minsky and Kay knew that bending the man to accommodate the machine was not the way to go about it. x86 is even worse than that because we're bending the man to a half-baked machine that is the result of a collection of historical missteps committed by guys who were geniuses at chemistry and physics, but amateurs at computing. Then to add insult to injury, in the early days of the PC, IBM drug their feet and tried to hobble the thing enough so that it wouldn't eat into their mainframe sales. I believe that was part of why Microsoft parted ways with them.
        mi100hael 9y ago
        Maybe that's true, but it's not like I can go out and buy a VAX laptop at Best Buy. In light of current circumstances, Rutkowska has developed a solution that's arguably more than just "reasonably" secure.

jstewartmobile 9y ago

I respect Rutkowska. That being said, I also think she's putting a band-aid on a festering sore most people call the PC architecture. Security guys have been going on about "defense-in-depth" for decades, and it all still looks like a trash fire to me. From a systems perspective, you don't make things more robust by adding more layers that can break. You do it by simplifying it down to something manageable, then managing it. You call it a security layer. I call it an extra attack surface.

jerheinze 9y ago
Using your own reasoning one would end up with absurd conclusions such as that sandboxing shouldn't be added, "You call it a security layer. I call it an extra attack surface." Therefore your reasoning is fallacious.
- jstewartmobile 9y ago
  My reasoning is no more fallacious than your reading comprehension. If sandboxing is necessary to make things manageable, it should be baked-in rather than being yet another moving layer inserted into the hundreds we already have. The combinatorics of PC development/security/maintenance/etc are ridiculous enough as it is.
  - jerheinze 9y ago
    You're still missing the point which is that it doesn't make it less secure (which is what you claimed), in fact, it makes it more secure.
jnwatson 9y ago
Rutkowsja herself has done more to expose the broken bits of x86 than probably anyone else. Remember blue pill? That was her. Also important work in SMM and Intel TXT. I'd say she is well aware of the limitations of her product.
- jstewartmobile 9y ago
  Nothing but respect for Rutkowska. Still think x86 and PC architecture are the kinds of abomination that should be cleansed with fire.
  - mi100hael 9y ago
    So your security solution is to just quit using computers?
    - jstewartmobile 9y ago
      Look into the many different architectures developed from the 60s all the way up to the early 80s. B5000, Symbolics, Alto, VAX, Connection Machine, etc... There are so many ways to go about it, and we really chose the wrong door. Even back in the 70s, guys like Minsky and Kay knew that bending the man to accommodate the machine was not the way to go about it. x86 is even worse than that because we're bending the man to a half-baked machine that is the result of a collection of historical missteps committed by guys who were geniuses at chemistry and physics, but amateurs at computing. Then to add insult to injury, in the early days of the PC, IBM drug their feet and tried to hobble the thing enough so that it wouldn't eat into their mainframe sales. I believe that was part of why Microsoft parted ways with them.
      - mi100hael 9y ago
        Maybe that's true, but it's not like I can go out and buy a VAX laptop at Best Buy. In light of current circumstances, Rutkowska has developed a solution that's arguably more than just "reasonably" secure.