41 ms·
In this age where major security flaws are being discovered in hardware, do we really want to offload network filtering to what might be black box hardware with
by chrissnell 9y ago
In this age where major security flaws are being discovered in hardware, do we really want to offload network filtering to what might be black box hardware with limited/no auditability?
- viraptor 9y agoThere are various levels of offloading. There are basic operations like checksum offloading that existed for a long time and it's optional. Not sure anyone would complain about the auditability of that one. (you would see errors on the next hop if it didn't work correctly)
- kardos 9y agoI interpreted OP's point as moving that kind of complexity to a black box would open it up to being compromised and then leveraged as a backdoor into your system, or as a botnet, etc.
- kardos 9y agoWe already have plenty of insecure non-auditable black boxes on our networks [1,2] and in our CPUs [3]. A dodgy offload chip seems like a minor concern until those are solved [1] https://www.networkworld.com/article/3016992/security/juniper-firewalls-compromised-by-spy-code-what-you-need-to-know.html https://www.networkworld.com/article/3016992/security/junipe... [2] https://www.theregister.co.uk/2015/09/15/compromised_cisco_routers/ https://www.theregister.co.uk/2015/09/15/compromised_cisco_r... [3] https://en.wikipedia.org/wiki/Intel_Management_Engine#Security_vulnerabilities https://en.wikipedia.org/wiki/Intel_Management_Engine#Securi...