4 ms·

Hi Nick! I'm still working on certification and guards, but in a very early stage company now. Do you know I can predict and (sometimes) control the progress of

Hi Nick! I'm still working on certification and guards, but in a very early stage company now. Do you know I can predict and (sometimes) control the progress of certification testing of cross domain solutions? That was my PhD. Now I'm working to rid the world of CDS boxes built on PCs running Linux; I know exactly what you mean. It doesn't matter that you're running SE Linux; the vulnerabilities are lower down in the hardware—Meltdown and Spectre and what's coming after Spectre will go right through your VMs and your policy enforcement and your hardened OS. What's needed is a completely different way of solving the cross domain problem; that's what I've got in prototype. I've taught Clive's energy gap notion to my students in university classes. That notion is deeply ingrained in what I'm proposing now. Could I talk with you in more detail about that idea of yours for visually inspectable process node?

nickpsecurity 9y ago
"Do you know I can predict and (sometimes) control the progress of certification testing of cross domain solutions? That was my PhD." Sounds more like engineering or process control than ad hoc. That's a good improvement. Esp if someone is assessing time to market or cost-effectiveness. "that's what I've got in prototype." Good. Hopefully, everyone does it a bit differently, too, for a security through diversity benefit. Too much monoculture going on even in old high-assurance systems that all built on GEMSOS, SNS, STOP, or LOCK. Three of which were really similar in security enforcement, too. "I've taught Clive's energy gap notion to my students in university classes. " He just did another write-up on that with some new channel ideas built-in here: https://www.schneier.com/blog/archives/2018/02/friday_squid_bl_612.html#c6769802 https://www.schneier.com/blog/archives/2018/02/friday_squid_... "Could I talk with you in more detail about that idea of yours for visually inspectable process node?" Sure. Just send an email to the address in my HN profile. It's still good.
- jloughry 9y ago
  Thanks for the Clive reference. I hadn't seen it.

nickpsecurity 9y ago

"Do you know I can predict and (sometimes) control the progress of certification testing of cross domain solutions? That was my PhD." Sounds more like engineering or process control than ad hoc. That's a good improvement. Esp if someone is assessing time to market or cost-effectiveness. "that's what I've got in prototype." Good. Hopefully, everyone does it a bit differently, too, for a security through diversity benefit. Too much monoculture going on even in old high-assurance systems that all built on GEMSOS, SNS, STOP, or LOCK. Three of which were really similar in security enforcement, too. "I've taught Clive's energy gap notion to my students in university classes. " He just did another write-up on that with some new channel ideas built-in here: https://www.schneier.com/blog/archives/2018/02/friday_squid_bl_612.html#c6769802 https://www.schneier.com/blog/archives/2018/02/friday_squid_... "Could I talk with you in more detail about that idea of yours for visually inspectable process node?" Sure. Just send an email to the address in my HN profile. It's still good.

jloughry 9y ago
Thanks for the Clive reference. I hadn't seen it.