3 ms·

> The problem is not in any particular stack. It’s system design overall. Are you aware that unlike Windows, Chromium OS has been designed from the ground up w

by krn 6y ago

> The problem is not in any particular stack. It’s system design overall. Are you aware that unlike Windows, Chromium OS has been designed from the ground up with security in mind[1]? And that it can run on almost any hardware[2]? > All your mentioned alternatives could just as easily fail if not properly secured. Software has to be designed and chosen with security in mind from the beginning. If a hospital is running Windows Server instead of automatically-updating, minimal Container Linux[3], it has a much larger attack vector space. These two factors alone (a proper client OS, and a proper server OS) can reduce the probability of a successful ransomware attack to almost zero. [1] https://www.chromium.org/chromium-os/chromiumos-design-docs/security-overview https://www.chromium.org/chromium-os/chromiumos-design-docs/... [2] https://get.neverware.com/healthcare/ https://get.neverware.com/healthcare/ [3] https://getfedora.org/en/coreos https://getfedora.org/en/coreos

jacobush 6y ago
What about credentials? Access? Administration? DDOS attacks? I think you can’t tell the attack space from a glance like that. And there’s ways to properly lock down Windows installations too, patched or not. Careful systems design and planning is key, regardless of exact components.
- krn 6y ago
  > What about credentials? Access? Administration? That has been a solved problem, at least in Chromium OS[1]. Even hardware-based two-factor authentication can be required for all users by a click of a button. > DDOS attacks? If it's self-hosted by a hospital locally, most parts of the system should not be available on an open network. If it's not self-hosted locally, the largest European hosting provider, OVH, can survive a 1.1 Tbps DDoS attack[2]. > Careful systems design and planning is key, regardless of exact components. If the solution is not designed around up-to-date technical components, it can fail regardless of careful planning. [1] https://support.google.com/chrome/a/answer/1289314?hl=en https://support.google.com/chrome/a/answer/1289314?hl=en [2] https://arstechnica.com/information-technology/2016/09/botnet-of-145k-cameras-reportedly-deliver-internets-biggest-ddos-ever/ https://arstechnica.com/information-technology/2016/09/botne...
  - jacobush 6y ago
    You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, using the same password for several people, using the same account for several people and so on. In large organisations, the problems are always found in the organisation itself, seldom in whatever tech stack is used. That they used unpatched Windows installations is not the disease, it's a symptom of the disease. You can enthusiastically treat the symptoms and improve the condition of the patient, but unless you go to the root causes, the patient will find new ways to be ill and you can 't be there to band-aid everything, all the time.

by krn 6y ago

jacobush 6y ago

What about credentials? Access? Administration? DDOS attacks? I think you can’t tell the attack space from a glance like that. And there’s ways to properly lock down Windows installations too, patched or not. Careful systems design and planning is key, regardless of exact components.

krn 6y ago
> What about credentials? Access? Administration? That has been a solved problem, at least in Chromium OS[1]. Even hardware-based two-factor authentication can be required for all users by a click of a button. > DDOS attacks? If it's self-hosted by a hospital locally, most parts of the system should not be available on an open network. If it's not self-hosted locally, the largest European hosting provider, OVH, can survive a 1.1 Tbps DDoS attack[2]. > Careful systems design and planning is key, regardless of exact components. If the solution is not designed around up-to-date technical components, it can fail regardless of careful planning. [1] https://support.google.com/chrome/a/answer/1289314?hl=en https://support.google.com/chrome/a/answer/1289314?hl=en [2] https://arstechnica.com/information-technology/2016/09/botnet-of-145k-cameras-reportedly-deliver-internets-biggest-ddos-ever/ https://arstechnica.com/information-technology/2016/09/botne...
- jacobush 6y ago
  You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, using the same password for several people, using the same account for several people and so on. In large organisations, the problems are always found in the organisation itself, seldom in whatever tech stack is used. That they used unpatched Windows installations is not the disease, it's a symptom of the disease. You can enthusiastically treat the symptoms and improve the condition of the patient, but unless you go to the root causes, the patient will find new ways to be ill and you can 't be there to band-aid everything, all the time.