3 ms·

i'd love to see any computer system that can provide a crytographically tamper proof log that comes with cryptographic proofs that: a) a specific set of source

by a-dub 5y ago

i'd love to see any computer system that can provide a crytographically tamper proof log that comes with cryptographic proofs that: a) a specific set of source code was used to generate the logs... so cryptographic security from source text files through compilation to execution on the hardware. b) that specific set of software was run on a specific machine at a specific time. it's hard... but beyond that, pretty much all audit logs are just security theater anyhow. sometimes can be mitigated by sending them to multiple places, but they're still meaningless unless you have a proof of what exactly generated them.

bredren 5y ago
I don’t think they need to be tamper proof, but I do think they need to be held criminally liable if they are tampered with. Volkswagen tampered with regulated measurements and got away with it for a while. But it was discovered and they paid a huge price for it. With that precedent, it should create incentive to deal with mistakes transparently. It does also mean transportation authorities will need to create some amount of leeway for mistakes. But I think there has been plenty of that given to traditional auto manufacturers.
- a-dub 5y ago
  that sort of inches at my point. how exactly would this criminal liability work? it would be comprised of two classes of evidence: 1) unassured/untrusted digital evidence that can be fabricated to say anything, leaving no trace of its previous state. (unless digital forensics has advanced well beyond what i know to be possible) 2) personal testimony that can also be fabricated. i suppose what's new here is that in a digital world, bits can be set however one likes with no trace of their previous state, where physical evidence left behind physical manifestations of itself. imagine rootkits that seek not to steal or hide their existence, but rather exist to plant fabricated evidence or hide actual evidence. in today's untrusted computer systems, this is all possible, and terrifying.

by a-dub 5y ago

bredren 5y ago

I don’t think they need to be tamper proof, but I do think they need to be held criminally liable if they are tampered with. Volkswagen tampered with regulated measurements and got away with it for a while. But it was discovered and they paid a huge price for it. With that precedent, it should create incentive to deal with mistakes transparently. It does also mean transportation authorities will need to create some amount of leeway for mistakes. But I think there has been plenty of that given to traditional auto manufacturers.

a-dub 5y ago
that sort of inches at my point. how exactly would this criminal liability work? it would be comprised of two classes of evidence: 1) unassured/untrusted digital evidence that can be fabricated to say anything, leaving no trace of its previous state. (unless digital forensics has advanced well beyond what i know to be possible) 2) personal testimony that can also be fabricated. i suppose what's new here is that in a digital world, bits can be set however one likes with no trace of their previous state, where physical evidence left behind physical manifestations of itself. imagine rootkits that seek not to steal or hide their existence, but rather exist to plant fabricated evidence or hide actual evidence. in today's untrusted computer systems, this is all possible, and terrifying.