4 ms·
With supply chain attacks, all code is untrusted.
by wffurr 5y ago
With supply chain attacks, all code is untrusted.
- andrewinardeer 5y agoUnless you mine your own silicon all hardware is untrusted.
- FredPret 5y agoOnly if you write every bit of code and trust every person involved in the entire value chain
- kirubakaran 5y agoBut even then, do you trust yourself?
- FredPret 5y agoRight, what if you’ve been Inception-ed by an adversary
- FranchuFranchu 5y agoMaybe the NSA installed a backdoor in your brain.
- ant6n 5y agoWith JavaScript in Browsers, every consumer pc runs untrusted code every day.
- patrickthebold 5y agoI don't think it's so black and white. When I install some software I'm trusting the developer and the package maintainer, and I'm sure others. If I go to gmail, I'm trusting google. That's not a huge difference at the end of the day. I suppose it's easier to navigate around to lots of websites than it is to go an install a bunch of software. But then again, browser exploits have been a thing forever. I expect that something bad will happen to my computer if I'm visiting shady websites. So my question is: are shady websites _more_ dangerous now that these side channel attacks have been discovered? (serious question.)
- remram 5y agoYou're trusting Google to do what? Google is not trying to attack you, but they are using a different threat model than what you describe. In particular Google is in the business of serving ads to you, that they do not author themselves, and are written with the assumption that you are not blindly running all their code ring0.
- acdha 5y agoBut they do so in a highly-sandboxed environment which has constantly evolving mitigations to counter exactly this threat.
- tgb 5y agoSure, but you don't need to mitigate timing attacks on untrusted code if that code already has root access.
- hedora 5y agoYou mean it’s untrustworthy code. Supply chain attacks exploit that fact that far too much code is inappropriately trusted.