8 ms·
CLIP OS – France’s cybersecurity agency’s open source, secured operating system
- Yoric 8y agoIf someone has already looked at the source, would it be possible to get a high-level overview of what's special to this OS? Apparently, authorizations and isolation are not vanilla Linux, but that's all I manage to gather from the description. edit Oh, I hadn't seen that document: https://docs.clip-os.org/clipos/architecture.html https://docs.clip-os.org/clipos/architecture.html So, container-based isolation between applications & users. I don't see anything about authorizations, though.
- chrisper 8y agoI am surprised that document isn't in French only...
- kwhitefoot 8y agoFrench academics, researchers, and software developers publish a lot in English. You might be exhibiting an out of date stereotype. :-)
- Tehnix 8y agoIt is most definitely not an out of date stereo type that (a looot of) French people are not particularly fond of English. Go to any university and you’d be surprised about the amount of students that don’t speak English, or can just muster a couple of words. It ingrained in the culture, from dubbing movies and series, having previously been the lingua franca of academics, culture etc, having a large part of the country in rural places, and (in some places) being seen as arrogant of you speak English or say English phrases. Source: French girlfriend, French friends and having been there a lot.
- marmaduke 8y agoHi, source I’m an uni engineer in France, everyone in my 100+ lab speaks English. What’s more is there’s a funny reversal occurring where people insert English phrases to be hip, eg in the middle of a French sentence, you hear a “yes” or a “let’s go” or a “in z pocket” (I never understood that last one)
- etiennemarcel 8y ago"in the pocket"? as in the literal translation of "c'est dans la poche" (meaning "I got this, it's easy")
- reaperducer 8y agoI'm not sure if it's a stereotype, or simply outdated. Much of what happened at the UN in its early decades was in French first, then English and the rest. I could see this happening at all levels within France, since it has such pride in its language. Unless that's an outdated notion, too.
- chrisper 8y agoConsidering my traffic ticket was all french, I don't know if it's outdated.
- snvzz 8y ago>Based on a Linux kernel Way to disappoint me. I was expecting some cool pure microkernel goodness, perhaps based on seL4.
- Klover 8y agoPerhaps cool factor is not their goal ;)
- snvzz 8y agoIf security is their goal, even more so. Linux can't be made secure for a very simple reason: The kernel is huge, and all of it runs in supervisor mode.
- agumonkey 8y agoperfectionnism vs pragmatism ? Maybe making a full fledged sel4 OS would take years ... I don't know.
- akavel 8y agoIt is rather: security vs. non-security. Pragmatism pulls in the non-security direction. When security people see "Linux-based", they already know the thing is situated at some particular point on the scale, or worse. Linux has big TCB surface, so it's intrinsically hard to secure.
- KenanSulayman 8y agoFascinating! It seems like a cross-over concept of CoreOS and FreeBSD jails. It seems as if it is just the base system for now (and a bit complex), but I think this kind of architecture is great for “IoT” use-cases when the source of the sensor data should be protected from the containers who are processing the data (i.e. in sealed environments). Can't wait to try this.
- chupasaurus 8y agoThat's based on just a Linux namespaces.
- close04 8y agoThe concept also feels similar to Qubes OS.
- niutech 8y agoAccording to https://clip-os.org/en/ https://clip-os.org/en/ the differences with Qubes OS are: 1. The main mechanism for environment isolation is different: a) CLIP OS leverages Linux kernel primitives to create containers with the help of additional features brought by Vserver, Linux kernel hardening (grsecurity for version 4) and a tailored Linux Security Module (LSM). This approach allows a fine-grained control on the data exchanges between isolated environments (e.g., handling a notion of files, processes and sockets) and permissions (e.g., restriction to ring 3 features for malicious code, limitation on the allowed system calls). b) Qubes OS leverages hardware based virtualization with an hypervisor (Xen), and a main virtual machine (dom0) which is a GNU/Linux system with services handling data exchange between virtual machines. 2. Administrators have different roles and power: a) Administrators on a CLIP OS system are not able to compromise system integrity nor access user data. They can only access a restricted set of configuration options. b) On Qubes OS systems, the main user of each virtual machine is also the administrator of its own environment. The system administrator of the main domain (dom0) can change all the configuration options and may access all user data without any restriction.
- mtgx 8y agoSo it seems closer to Subgraph OS (except for the Tor usage): https://subgraph.com/sgos/ https://subgraph.com/sgos/
- Timothycquinn 8y agoSaw the same. The thing I like about Qubes OS is that they are trying to move to an OS / hypervisor agnostic model. I personally would love to see Qubes on freenas driving Jails.
- comboy 8y ago> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU.
- agumonkey 8y agoworth a ticket on a bug tracker
- ardy42 8y ago>> It also provides partitioning mechanisms that make it possible to simultaneously process public and sensitive information on the same computer, within two completely isolated software environments, in order to avoid the risk of sensitive information leaking onto the public network. > Just don't. Please don't. You can have the most sane architecture, but there's a whole pile of s..tack underneath. You can't even trust a modern CPU. Wasn't it determined in 1974 that you can't successfully do that using conventionally developed software, even without the bloated modern "stack?" Multics Security Evaluation: Vulnerability Analysis: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/karg74.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... Thirty Years Later: Lessons from the Multics Security Evaluation: https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf
- comboy 8y agoI'm gonna dive into those later, thank you. The way I see it, sensitive information should be offline. But you often need to access it in an automated manner. So set up a secure interface. Secure means that the protocol is minimalistic and you are monitoring unusual access patterns. E.g. serial interface with the sensitive data computer, where you only ask for X and it provides you X. Almost never you need to fetch all data at once. So you can set up some hourly limits or whatever. You can use microcontroller to validate data transmission. You can set up a hardware button if necessary. The beauty of it, is that the sensitive box could be running windows 3.11. The attack surface as minimal as it can be. When you have it on a computer that's connected to the Internet, in my eyes you already lost the game. I'm quite convinced it looks the same in the eyes of some 3 letter agencies, and it sure gets an average script kiddie excited.
- ankka 8y agoThe most unexpected part was seeing "Gentoo Hardened" as a part of state-level official documentation.
- snaky 8y agoFrance is rather open-minded recently. "Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App" https://news.ycombinator.com/item?id=16933736 https://news.ycombinator.com/item?id=16933736
- transpute 8y ago> Hardware-based mechanisms and isolation are assumed trusted, properly functional and configured. Here is a non-exhaustive list of hardware-based security and isolation mechanisms: UEFI firmware, Secure Boot ... Is firmware a "hardware-based mechanism" with comparable isolation claims to a TPM, MMU or IOMMU? See the talk "Firmware is the new Software", on attack/defense of UEFI firmware vs auditable open-source firmware like LinuxBoot, https://www.platformsecuritysummit.com/2018/speaker/hudson/ https://www.platformsecuritysummit.com/2018/speaker/hudson/
- deleted 8y ago[deleted]
- baybal2 8y agoIt is a linux distro, not a new os
- AnIdiotOnTheNet 8y agoThe terminology is confusing because for a lot of purposes every Linux distro can be considered a separate platform, so it may as well be a separate OS even though it uses the same kernel (and often the same everything, just arranged and configured differently enough to cause headaches). That said, I am also disappointed that everyone who cobbles together a Linux distro these days insists on referring to it as a new OS, because I remember the days when people actually announced new OSs like Syllable, AROS, SkyOS, and Haiku. Lately I've seen the term "Operating Environment" emerging as a way to further delineate an actual "new OS" from something that just sits on top of an existing kernel but is more different than just a new Linux distribution.
- msla 8y agoThe Linux kernel isn't an OS, because it's a kernel. A Linux distro isn't an OS, because it's a distro. Rather raises the question of what, if anything, is an OS.
- rofo1 8y agoGitHub link: https://github.com/CLIPOS https://github.com/CLIPOS
- trolliii 8y agoFrance is known for building strong defense :)
- rossdavidh 8y agoVerdun turned out to be pretty darn strong, much to Germany's chagrin in WW1.
- bcaa7f3a8bbc 8y agoIt seems that ANSSI has sponsored many open-source researches and development efforts. One day I was surprised that the most complete free and open source implementation of OpenPGP Card firmware on JavaCard was published by ANSSI on GitHub.
- shiftoutbox 8y agoIts just Linux. French Linux at that.
- presscast 8y agoIs there a design whitepaper somewhere? (Or similar)
- djsumdog 8y agoHmm, they says it's Linux based. I was kinda expecting/hoping for something more similar to BAE's STOP, which is a non-open/proprietary OS that originally sacrificed performance/speed for security.
- jcwayne 8y agoTrusting an OS from any government seems, to me, a foolish thing to do.
- icc97 8y agoYou don't have to, it's for French government employees who have no other choice. However it's easier to trust an open source government OS than a closed source one.
- lawnchair_larry 8y agoThere is no point in debating whether or not this is secure. The inclusion of that word in the title is going to derail all of the comments here. They are using secure from the point of a layman. We know nothing is secure, the folks working on the project know nothing is secure. The government folks and media outlets don’t understand security and their use of the word “secure” should be disregarded. It would be better (and create more interesting discussion) to pretend that one is reading a title that says “security enhanced” operating system, and evaluate the merits of incremental improvements offered, and not debate whether or not anything can be truly secure.
- DINKDINK 8y agoRobust is probably a better word to describe attack resilience.
- renaudg 8y agoThis is actually a mistranslation. The original French text (https://clip-os.org/fr/ https://clip-os.org/fr/) says "système d’exploitation durci" (hardened operating system) and this has been translated as "secure" in the English version of that same page.
- nwmcsween 8y agoIt uses gentoi hardened? Get ready for tons of breakage.
- snaky 8y agoGoogle uses Gentoo as a base for ChromeOS IIRC.