5 ms·

Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to reall

Thanks for your elaboration. What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? I could go back to really old systems, but it does not make really sense to use the 'security through obfuscation' strategy, no?

shakna 8y ago
> What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.
- wuschel 8y ago
  Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
  - shakna 8y ago
    > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...

shakna 8y ago

> What do you think are the reasons that a "safe-by-default" CPU design has not yet seen the light of day? Tradeoffs, and motivations, really. This is going into the land of speculation and opinion, but I think that we did see some more secure CPUs in the past. I also expect that the military and some industries may have access to more secure versions of CPUs currently on the market. Being more performant became one priority, which lead to do unsafe things that allowed Spectre and others to become possible. And on the other hand, the more diverse and prolific technology becomes, the more interested in being able to access it in a surreptitious manner the government is. Many modern governments seem obsessed with getting as much data as they can - so much they can't even read it all. So on one hand you have pressure from consumers to improve speed at any cost, and on the other you have state actors pressuring to keep the status quo of semi-leaky hardware.

wuschel 8y ago
Thanks. Your speculations sound reasonable. I have no idea what kind of error checking procedure the CPU industry uses, but it is hard to believe that Intel et al. do not use highly integrated proof tools that cover multiple design layers. I know that these are very complex systems, that you can't cover certain cases with proof tools, and cost might be a factor at play - but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now.
- shakna 8y ago
  > but I believe that there is interest in private and public markets to get hands on a stack that starts with a higher security threshold compared with what we have now. There's certainly some interest, in some parts of industry. NASA [0] has an FPGA board they made to be more rugged, for CubeSats, which had multiple layers for preventing program corruption. I'd be shocked if it had a backdoor into it, and would expect parts of the system would make it more resistant to tampering. Unfortunately, I also expect that if any chip becomes something popular among consumers, state actors will push their weight and get their weaknesses. [0] https://www.nasa.gov/mission_pages/station/research/experiments/1998.html https://www.nasa.gov/mission_pages/station/research/experime...