3 ms·

> nobodys really addressed the elephant in the room. I think the elephant in the room is actually a more general issue that is cross platform and independent o

> nobodys really addressed the elephant in the room. I think the elephant in the room is actually a more general issue that is cross platform and independent of the product implementation. It’s 2021 and we are still ignoring the fundamental “best practice” that we’ve known about for at least 20 years. Systems should be isolated from each other unless there is an overwhelming need for them to be connected and everything should run with the least privilege. Centralised credential vaults and binary artefact repositories are an obvious example.

WalterBright 6y ago
It's also important to have diversity. For example, on the Boeing 757 there are two computers that control the stab trim, that do the same thing. They must agree or both computers are automatically locked out. The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages. The idea, of course, is a design problem with one does not propagate to the other. If one program is used in all your infrastructure, all your infrastructure is compromised when that program has a bug.
- aasasd 6y ago
  > They must agree or both computers are automatically locked out As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.
  - WalterBright 6y ago
    I must remember to use "chronometer" rather than "clock".
  - hackeraccount 6y ago
    It's funny because it's true.
- KajMagnus 6y ago
  I wonder if there's a way to bring that approach, into the world of 1) software build servers, 2) third party dependencies, and 3) code review. 1) Build servers: Maybe by keeping it possible to build one's software on a laptop — then, when it's time to release something, one can build the software at the build server plus some people's laptops and compare hashes. 2) ??? 3) Different people who don't talk with each other, do security code review, independently of each other? Hmm does that make sense
StreamBright 6y ago
>> Systems should be isolated from each other unless there is an overwhelming need for them to be connected and everything And we should have checks built into the build pipelines and checksum the files that go into the build. We have Merkle trees for a long time. I think, it would be possible to detect injected code.

WalterBright 6y ago

It's also important to have diversity. For example, on the Boeing 757 there are two computers that control the stab trim, that do the same thing. They must agree or both computers are automatically locked out. The two computers are developed by two independent teams who are not allowed to talk to each other. Two different CPUs, two different algorithms, two different programming languages. The idea, of course, is a design problem with one does not propagate to the other. If one program is used in all your infrastructure, all your infrastructure is compromised when that program has a bug.

aasasd 6y ago
> They must agree or both computers are automatically locked out As a marine saying goes, never take two chronometers with you to the sea. Take either one or three.
- WalterBright 6y ago
  I must remember to use "chronometer" rather than "clock".
- hackeraccount 6y ago
  It's funny because it's true.
KajMagnus 6y ago
I wonder if there's a way to bring that approach, into the world of 1) software build servers, 2) third party dependencies, and 3) code review. 1) Build servers: Maybe by keeping it possible to build one's software on a laptop — then, when it's time to release something, one can build the software at the build server plus some people's laptops and compare hashes. 2) ??? 3) Different people who don't talk with each other, do security code review, independently of each other? Hmm does that make sense

StreamBright 6y ago

>> Systems should be isolated from each other unless there is an overwhelming need for them to be connected and everything And we should have checks built into the build pipelines and checksum the files that go into the build. We have Merkle trees for a long time. I think, it would be possible to detect injected code.