5 ms·

Is there a "now what?" if the board is compromised? I have... difficulty... understanding what you could possibly do to prevent full distributed system compromi

Is there a "now what?" if the board is compromised? I have... difficulty... understanding what you could possibly do to prevent full distributed system compromise if one hardware node is compromised. You seem very certain that something can be done, and I trust you, so I can trust that something can be done, but perhaps the solutions in this space elude me. I'll keep watching this space, but my pessimism may leak through from time to time.

WalterBright 5y ago
I can't answer it in detail because I don't know how those systems work. But if I did, I bet I could find a way. After all, it's clear to me how Fukushima and Deep Water Horizon both had an easily fixed single point of failure that doomed them, and I ain't no expert on nuclear reactors nor drilling rigs. When I got a job at Boeing, I thought it was impossible to design an airplane with full redundancy. They showed me how it was done.
- WalterBright 5y ago
  BTW, in airplane avionics, faulty boards are detected by having more than one board, and comparing the results. Ideally the different boards are different designs, different CPUs, different code, etc.
toast0 5y ago
In a 'well designed system', any given node has limited access to the other nodes and user data. If a node is compromised, that shouldn't turn into full access to everything. Specifics would vary depending on your application, but while most user facing servers might need to be able to validate a login token, few would need to be able to issue a login token or access billing details. If you compromise the node that has billing details or access to them, then you'll have them, but if you compromise a different node, you won't. That's better than compromise any host and get access to the 'private' network where there's no auth or encryption, which is kind of traditional.

WalterBright 5y ago

I can't answer it in detail because I don't know how those systems work. But if I did, I bet I could find a way. After all, it's clear to me how Fukushima and Deep Water Horizon both had an easily fixed single point of failure that doomed them, and I ain't no expert on nuclear reactors nor drilling rigs. When I got a job at Boeing, I thought it was impossible to design an airplane with full redundancy. They showed me how it was done.

WalterBright 5y ago
BTW, in airplane avionics, faulty boards are detected by having more than one board, and comparing the results. Ideally the different boards are different designs, different CPUs, different code, etc.

toast0 5y ago

In a 'well designed system', any given node has limited access to the other nodes and user data. If a node is compromised, that shouldn't turn into full access to everything. Specifics would vary depending on your application, but while most user facing servers might need to be able to validate a login token, few would need to be able to issue a login token or access billing details. If you compromise the node that has billing details or access to them, then you'll have them, but if you compromise a different node, you won't. That's better than compromise any host and get access to the 'private' network where there's no auth or encryption, which is kind of traditional.