4 ms·

>It's not that hard. eye roll

by phillmv 15y ago

rdl 15y ago
It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget. The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability. The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.
breck 15y ago
It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done. If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.
- munin 15y ago
  google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?
  - redthrowaway 15y ago
    If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.
    - brandon 15y ago
      Nope. Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...
      - vogonj 15y ago
        yup. "Microsoft thanks the following companies for working with us and for providing details of limited, targeted attacks against customers of Internet Explorer 6: Google Inc. and MANDIANT; Adobe; McAfee; French government CSIRT (CERTA)" http://technet.microsoft.com/en-us/security/bulletin/MS10-002 http://technet.microsoft.com/en-us/security/bulletin/MS10-00...
  - rdl 15y ago
    also needed: no users.
burgerbrain 15y ago
Bespoke hardware for government agencies with unlimited budgets is nothing new.
- rdl 15y ago
  I think for single-purpose machines (like "control a UAV"), custom hardware makes a lot of sense, even for commercial operations. Unfortunately custom hardware usually ends up being a Windows box in a weird case, with some buttons connected over...USB. A requirement that all components of the TCB be FIPS 140-2 level 3+ for anything which is routinely used in combat operations would please me, I think. Right now that's just for the crypto modules themselves.

>It's not that hard. eye roll

by phillmv 15y ago

>It's not that hard. eye roll

rdl 15y ago

It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget. The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability. The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.

breck 15y ago

It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done. If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.

munin 15y ago
google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?
- redthrowaway 15y ago
  If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.
  - brandon 15y ago
    Nope. Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...
    - vogonj 15y ago
      yup. "Microsoft thanks the following companies for working with us and for providing details of limited, targeted attacks against customers of Internet Explorer 6: Google Inc. and MANDIANT; Adobe; McAfee; French government CSIRT (CERTA)" http://technet.microsoft.com/en-us/security/bulletin/MS10-002 http://technet.microsoft.com/en-us/security/bulletin/MS10-00...
- rdl 15y ago
  also needed: no users.

burgerbrain 15y ago

Bespoke hardware for government agencies with unlimited budgets is nothing new.

rdl 15y ago
I think for single-purpose machines (like "control a UAV"), custom hardware makes a lot of sense, even for commercial operations. Unfortunately custom hardware usually ends up being a Windows box in a weird case, with some buttons connected over...USB. A requirement that all components of the TCB be FIPS 140-2 level 3+ for anything which is routinely used in combat operations would please me, I think. Right now that's just for the crypto modules themselves.