3 ms·

IMO this is terrible advice. What happens after a decade when some or all of the desktops are way out of date? Are the doctors diligent about patching them? All

IMO this is terrible advice. What happens after a decade when some or all of the desktops are way out of date? Are the doctors diligent about patching them? All of the doctors? Likely the situation they’ll end up in is a bunch of old computers running outdated software that all ends up being a massive security threat. Let’s say in 2005 one of the doctors wanted to video chat with their kid, and the kid tells them to download teamviewer. Chances are, 15 years later in 2020, that 2005 version of teamviewer is still going to be on that computer. I know this because I work in a psychiatric research institute (though not in IT) and this kind of stuff happens all the time. It’s not everyone, but in this case the weakest link breaks the chain.

mschuster91 6y ago
> Are the doctors diligent about patching them? Why should they be, if the system is airgapped?
- jasonjayr 6y ago
  Not only airgapped, but it sounds like they were physically locked up when the Dr was not present. If they had full disk encryption too, that sounds like a pretty good solution for running old hardware securely.
metalliqaz 6y ago
sounds like the PCs were air gapped
willvarfar 6y ago
I wasn’t recommending something, I was describing it! This was before the internet. The very real threat were people trying to locate young victims taken into care etc. The center, on their own initiate, mitigated this by physically locking the computers into safes. They also used classic usernames and passwords, but I don’t think encrypted storage was a thing then.
- Bukhmanizer 6y ago
  Ah sorry, made too many assumptions.
  - KajMagnus 6y ago
    I suppose that as long as a computer lacks any network interface card, it's comparatively safe, compared to most organizations today? @willvarfar, About the safes — did they expect (or worry about) someone to breaking in, and power on and try to access the computers? Or/and was it to protect against "insiders"? (say, someone in the staff got bribed, or a janitor or some other 3rd party person?) I wonder how they got data out from those computers? If by connecting to a printer, to print on paper, then, was that via a cable? Was the printer connected to any network? Hmm but you wrote that this was before the Internet, so, then, maybe only an intranet? and no wifi, only cables? Maybe they copied data in text files on floppy disks? What do they do instead nowadays, if you happen to know? > The very real threat were people trying to locate young victims taken into care etc Who are the people who want to do such things? Was it the same underlying reason as this time — extortion and making money? Or something else? If it's okay to ask / if you happen to know
    - willvarfar 6y ago
      its late but I'll try and answer :) The 'safes' were really just very sturdy cabinets designed to house a PC and a dot-matrix printer etc. I'm sure they weren't fire-proof but they were really heavily built. They did have power and network cables entering, obviously. There was a netware server in back of a cupboard. It backed up nightly to DAT tapes. That room was also properly locked. When children are taken into care, the abusers are strongly motivated to try and contact the child to intimidate them into remaining quiet. Etc. Its uncomfortable to think about that side of things.
      - KajMagnus 6y ago
        Thanks for explaining. That last thing — yes that sounds uncomfortable to think about. Hmm network cables, decades ago — I suppose that back then, hacking over the Internet wasn't really a thing, (?) so I suppose that wasn't much of an issue. Or maybe it was a local network only (for backup)
appleflaxen 6y ago
this sounds about a thousand times more secure than a state of the art cloud solution, because the physical isolation (even with outdated software) is so robust. I think whether it's a local optimum vs. a global optimum can be debated, but to call it "terrible advice" is way off the mark.
raxxorrax 6y ago
And yet a compromisation is still far more unlikely than hosting it on the next shitty cloud application. Any cloud application and a threat analysis on data will reveal exactly that. And it won't even be close.

mschuster91 6y ago

> Are the doctors diligent about patching them? Why should they be, if the system is airgapped?

jasonjayr 6y ago
Not only airgapped, but it sounds like they were physically locked up when the Dr was not present. If they had full disk encryption too, that sounds like a pretty good solution for running old hardware securely.

metalliqaz 6y ago

sounds like the PCs were air gapped

willvarfar 6y ago

I wasn’t recommending something, I was describing it! This was before the internet. The very real threat were people trying to locate young victims taken into care etc. The center, on their own initiate, mitigated this by physically locking the computers into safes. They also used classic usernames and passwords, but I don’t think encrypted storage was a thing then.

Bukhmanizer 6y ago
Ah sorry, made too many assumptions.
- KajMagnus 6y ago
  I suppose that as long as a computer lacks any network interface card, it's comparatively safe, compared to most organizations today? @willvarfar, About the safes — did they expect (or worry about) someone to breaking in, and power on and try to access the computers? Or/and was it to protect against "insiders"? (say, someone in the staff got bribed, or a janitor or some other 3rd party person?) I wonder how they got data out from those computers? If by connecting to a printer, to print on paper, then, was that via a cable? Was the printer connected to any network? Hmm but you wrote that this was before the Internet, so, then, maybe only an intranet? and no wifi, only cables? Maybe they copied data in text files on floppy disks? What do they do instead nowadays, if you happen to know? > The very real threat were people trying to locate young victims taken into care etc Who are the people who want to do such things? Was it the same underlying reason as this time — extortion and making money? Or something else? If it's okay to ask / if you happen to know
  - willvarfar 6y ago
    its late but I'll try and answer :) The 'safes' were really just very sturdy cabinets designed to house a PC and a dot-matrix printer etc. I'm sure they weren't fire-proof but they were really heavily built. They did have power and network cables entering, obviously. There was a netware server in back of a cupboard. It backed up nightly to DAT tapes. That room was also properly locked. When children are taken into care, the abusers are strongly motivated to try and contact the child to intimidate them into remaining quiet. Etc. Its uncomfortable to think about that side of things.
    - KajMagnus 6y ago
      Thanks for explaining. That last thing — yes that sounds uncomfortable to think about. Hmm network cables, decades ago — I suppose that back then, hacking over the Internet wasn't really a thing, (?) so I suppose that wasn't much of an issue. Or maybe it was a local network only (for backup)

appleflaxen 6y ago

this sounds about a thousand times more secure than a state of the art cloud solution, because the physical isolation (even with outdated software) is so robust. I think whether it's a local optimum vs. a global optimum can be debated, but to call it "terrible advice" is way off the mark.

raxxorrax 6y ago

And yet a compromisation is still far more unlikely than hosting it on the next shitty cloud application. Any cloud application and a threat analysis on data will reveal exactly that. And it won't even be close.