4 ms·

This seems like as good an excuse as any to post a link to the seminal “Reflections on Trusting Trust”: https://www.archive.ece.cmu.edu/~ganger/712.fall02/pape

by CPLX 8y ago

This seems like as good an excuse as any to post a link to the seminal “Reflections on Trusting Trust”: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7... It’s an absolute classic that I’m sure 97% of HN readers are familiar with, but for the 3% that aren’t it’s a really great meditation on just how difficult it is to trust any computing system, without somehow recursively assessing the trustworthiness of everything that has ever happened before.

nickpsecurity 8y ago
That was a paper reflecting on Paul Kargers compiler-compiler subversion he did in the 1970's evaluation of MULTICS. https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf The seminal paper on subversion in the lifecycle was from another high-assurace, security researcher named Philip Myers in 1980: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/myer80.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... The recommendations were carefully specifying what things do, implementing them in a structured way to inspect for backdoors, using safe languages to block regular vulnerabilities, using covert-channel analysis to find leaks, verifying things down to object code or transistors, letting people build from crypto-signed source, and using couriers for the hardware from trusted facilities onshore ("trusted trucks"). People ignored most of that. Even Thompson as he was obsessed with unsafe language vs Wirth whose work let you choose per module. It's coming back to bite everyone.
nickpsecurity 8y ago
Oh yeah, if any of you enjoyed Thompson's paper, you might enjoy this write-up that talks about discovering something like that: https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/ It took me 30min-1hr to read. I can't recall specifically. Worth it. :)

by CPLX 8y ago

nickpsecurity 8y ago

That was a paper reflecting on Paul Kargers compiler-compiler subversion he did in the 1970's evaluation of MULTICS. https://www.acsac.org/2002/papers/classic-multics.pdf https://www.acsac.org/2002/papers/classic-multics.pdf The seminal paper on subversion in the lifecycle was from another high-assurace, security researcher named Philip Myers in 1980: https://csrc.nist.gov/csrc/media/publications/conference-paper/1998/10/08/proceedings-of-the-21st-nissc-1998/documents/early-cs-papers/myer80.pdf https://csrc.nist.gov/csrc/media/publications/conference-pap... The recommendations were carefully specifying what things do, implementing them in a structured way to inspect for backdoors, using safe languages to block regular vulnerabilities, using covert-channel analysis to find leaks, verifying things down to object code or transistors, letting people build from crypto-signed source, and using couriers for the hardware from trusted facilities onshore ("trusted trucks"). People ignored most of that. Even Thompson as he was obsessed with unsafe language vs Wirth whose work let you choose per module. It's coming back to bite everyone.

nickpsecurity 8y ago

Oh yeah, if any of you enjoyed Thompson's paper, you might enjoy this write-up that talks about discovering something like that: https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/ It took me 30min-1hr to read. I can't recall specifically. Worth it. :)