4 ms·

Its not intractable. You just need to take the concept of a software supply chain seriously. E.G, every version of every dependency you use (either directly or

Its not intractable. You just need to take the concept of a software supply chain seriously. E.G, every version of every dependency you use (either directly or transitivly) needs to be audited and approved by a trusted supplier. This isn't nearly as bad as it sounds. You only need 1 trusted organization across the entire industry to certify a baseline of trusted software. Maybe a second organization to cover people who don't trust the first. The NSA, some other part of US cyber command, or a comparable agency from a different government are all natural choices; as they have a vested interest in protecting critical domestic infrastructure but no commercial interest in keeping their work proprietary. Since that infrastructure all runs the same software as the rest of industry, we all benefit.

dragonwriter 4y ago
> The NSA, some other part of US cyber command, or a comparable agency from a different government are all natural choices; as they have a vested interest in protecting critical domestic infrastructure NSA is not a natural choice, since they are an active threat that has a history of abusing trust in their defensive mandate to insert vulnerabilities into systems in pursuit of their offensive mission.
- lrhegeba 4y ago
  Then you can decide for your org to not trust them and perhaps use a different certifier. i would welcome them offering such a service instead of having none.
  - voakbasda 4y ago
    Trust like this is transitive, so I would not trust any organization that placed such blind faith in the NSA. I hope your brave new world includes a requirement for orgs to disclose their software auditor, so my org can avoid trusting orgs like yours.
Hizonner 4y ago
> You only need 1 trusted organization across the entire industry to certify a baseline of trusted software. So it's not just bad, but impossible. Got it. More to the point, software "auditing" does not work reliably against deliberately malicious code written by competent actors, never has, and never will. It's too easy to slip in subtle back doors that reviewers won't notice, and at the same time too hard to keep up with the review workload.
mnw21cam 4y ago
I would suggest the Debian Project and similar distributions as a fairly good scaffold on which to build such a system. All it needs is a notarisation mechanism, so certify that a person has had eyes on the code and says that it is ok. Plus, I'd trust them more than the US government. Though there's no harm in having multiple bodies all certify a code-base.
- bombolo 4y ago
  But Linus has said distributions are bad because they don't let him fork libraries as he pleases!
  - bombolo 4y ago
    I guess the downvotes stem from not knowing what specific episode I'm talking about
klabb3 4y ago
> The NSA, […has] a vested interest in protecting critical domestic infrastructure One of the biggest cluster of cyber attacks ever, WannaCry, is attributed to NSA directly. They developed and sat on the exploit for 5 years, until it leaked, because even the NSA can be compromised. Government lives in a “we need good guys to have the biggest guns” Cold War-like mindset and are terrible role models for championing cyber security. Auditing in general is primarily used as a tool to shift liability, or “ass-covering”, and sell a false sense of security by abusing information asymmetry. That said, there’s nothing wrong with auditing when deployed within a more informed and aligned incentive structure.
esperent 4y ago
> The NSA Seriously? As soon as the NSA certifies a piece of code it'll be dropped like a hot potato by everyone outside of the US, and probably by a large percentage of the people inside it. If such a body exists, which seems like a reasonable idea, it has to be nongovernmental and not controlled by large corporations either.
- kortilla 4y ago
  This doesn’t make sense. The NSA has certified lots of crypto protocols that we use.
  - esperent 4y ago
    Those also presumably have been checked, verified, and certified by many other governments, institutions, and independent mathematicians. I'm not against the NSA, FSB, 3PLA, GCHQ or any other letter based agency certifying things. I'm saying they can't become the main official certifying body for FOSS because it simply won't be accepted by the FOSS community or by other world governments.
  - mkj 4y ago
    These days it seems those protocols are used in spite of NSA involvement. See what happened with Speck in the Linux kernel. https://lwn.net/Articles/761992/ https://lwn.net/Articles/761992/
  - leosarev 4y ago
    And if you has to be Russian or China government certified, all this protocols are out of question.
cortesoft 4y ago
Ok, even if we could all agree on a single trusted auditor, that would still put us in a very bad position. You would be limited to only use that baseline trusted set of software, which I guarantee won’t be sufficient for all the things you need as software grows and develops.
numpad0 4y ago
You would be right if we were all running properly engineered hardware and software, but software engineering stopped being a subcategory of engineering 30+ years ago. Software engineers are all blacksmiths, and software products equates to artisan made weapons. A food poisoning traced to a chef's knife from a workshop affects all users of the knife, but the impact is often localized to the shop and lessons learned are shared less as a scientific theory but more or less as an epic(see how "postmortems" are requested or written). I predict that software supply chain concept will start working when software become a field of engineering, as in a single bit of error stops being the direct cause of a catastrophic failure(e.g. a web server bootloop), parts become replaceable(e.g. universal SATA host driver compiled against musl libc running just fine with glibc or proprietary Unix libc), so on and forth, maybe once anyone will be able to code or AI would start taking over us, or something - but at this moment where everyone touching software must be all manager-architect-manufacturer-user that knows where to put a chalk mark, even the idea of software "components" only barely work.
NikolaNovak 4y ago
Software exists outside of USA. I mean, I'm in Canada, friendly as it gets, and still - is NSA certifying a piece of software a good thing, from my perspective? From my company's perspective? From my Canadian sovereign government's perspective? There may be second order effects at play here.
- abdullahkhalids 4y ago
  NIST in consultations with various US public and private actors (including NSA) already determine the cryptographic algorithms that are used to run the internet. Canada is still very friendly with the US - the countries that have literally been bombed by the US - continue to use these algorithms. Governments across the world have large gaps in their understanding of software and its relation to the world.
bombolo 4y ago
> to certify a baseline of trusted software. check how it works with FIPS for USA government. Out of date and you can't use a regular distribution because it doesn't use it, because it's expensive to get certified.

dragonwriter 4y ago

> The NSA, some other part of US cyber command, or a comparable agency from a different government are all natural choices; as they have a vested interest in protecting critical domestic infrastructure NSA is not a natural choice, since they are an active threat that has a history of abusing trust in their defensive mandate to insert vulnerabilities into systems in pursuit of their offensive mission.

lrhegeba 4y ago
Then you can decide for your org to not trust them and perhaps use a different certifier. i would welcome them offering such a service instead of having none.
- voakbasda 4y ago
  Trust like this is transitive, so I would not trust any organization that placed such blind faith in the NSA. I hope your brave new world includes a requirement for orgs to disclose their software auditor, so my org can avoid trusting orgs like yours.

Hizonner 4y ago

> You only need 1 trusted organization across the entire industry to certify a baseline of trusted software. So it's not just bad, but impossible. Got it. More to the point, software "auditing" does not work reliably against deliberately malicious code written by competent actors, never has, and never will. It's too easy to slip in subtle back doors that reviewers won't notice, and at the same time too hard to keep up with the review workload.

mnw21cam 4y ago

I would suggest the Debian Project and similar distributions as a fairly good scaffold on which to build such a system. All it needs is a notarisation mechanism, so certify that a person has had eyes on the code and says that it is ok. Plus, I'd trust them more than the US government. Though there's no harm in having multiple bodies all certify a code-base.

bombolo 4y ago
But Linus has said distributions are bad because they don't let him fork libraries as he pleases!
- bombolo 4y ago
  I guess the downvotes stem from not knowing what specific episode I'm talking about

klabb3 4y ago

> The NSA, […has] a vested interest in protecting critical domestic infrastructure One of the biggest cluster of cyber attacks ever, WannaCry, is attributed to NSA directly. They developed and sat on the exploit for 5 years, until it leaked, because even the NSA can be compromised. Government lives in a “we need good guys to have the biggest guns” Cold War-like mindset and are terrible role models for championing cyber security. Auditing in general is primarily used as a tool to shift liability, or “ass-covering”, and sell a false sense of security by abusing information asymmetry. That said, there’s nothing wrong with auditing when deployed within a more informed and aligned incentive structure.

esperent 4y ago

> The NSA Seriously? As soon as the NSA certifies a piece of code it'll be dropped like a hot potato by everyone outside of the US, and probably by a large percentage of the people inside it. If such a body exists, which seems like a reasonable idea, it has to be nongovernmental and not controlled by large corporations either.

kortilla 4y ago
This doesn’t make sense. The NSA has certified lots of crypto protocols that we use.
- esperent 4y ago
  Those also presumably have been checked, verified, and certified by many other governments, institutions, and independent mathematicians. I'm not against the NSA, FSB, 3PLA, GCHQ or any other letter based agency certifying things. I'm saying they can't become the main official certifying body for FOSS because it simply won't be accepted by the FOSS community or by other world governments.
- mkj 4y ago
  These days it seems those protocols are used in spite of NSA involvement. See what happened with Speck in the Linux kernel. https://lwn.net/Articles/761992/ https://lwn.net/Articles/761992/
- leosarev 4y ago
  And if you has to be Russian or China government certified, all this protocols are out of question.

cortesoft 4y ago

Ok, even if we could all agree on a single trusted auditor, that would still put us in a very bad position. You would be limited to only use that baseline trusted set of software, which I guarantee won’t be sufficient for all the things you need as software grows and develops.

numpad0 4y ago

You would be right if we were all running properly engineered hardware and software, but software engineering stopped being a subcategory of engineering 30+ years ago. Software engineers are all blacksmiths, and software products equates to artisan made weapons. A food poisoning traced to a chef's knife from a workshop affects all users of the knife, but the impact is often localized to the shop and lessons learned are shared less as a scientific theory but more or less as an epic(see how "postmortems" are requested or written). I predict that software supply chain concept will start working when software become a field of engineering, as in a single bit of error stops being the direct cause of a catastrophic failure(e.g. a web server bootloop), parts become replaceable(e.g. universal SATA host driver compiled against musl libc running just fine with glibc or proprietary Unix libc), so on and forth, maybe once anyone will be able to code or AI would start taking over us, or something - but at this moment where everyone touching software must be all manager-architect-manufacturer-user that knows where to put a chalk mark, even the idea of software "components" only barely work.

NikolaNovak 4y ago

Software exists outside of USA. I mean, I'm in Canada, friendly as it gets, and still - is NSA certifying a piece of software a good thing, from my perspective? From my company's perspective? From my Canadian sovereign government's perspective? There may be second order effects at play here.

abdullahkhalids 4y ago
NIST in consultations with various US public and private actors (including NSA) already determine the cryptographic algorithms that are used to run the internet. Canada is still very friendly with the US - the countries that have literally been bombed by the US - continue to use these algorithms. Governments across the world have large gaps in their understanding of software and its relation to the world.

bombolo 4y ago

> to certify a baseline of trusted software. check how it works with FIPS for USA government. Out of date and you can't use a regular distribution because it doesn't use it, because it's expensive to get certified.