6 ms·

Security was absolutely considered during the design process of Windows and iOS. I'm less familiar with AWS and Linux history but it's hard for me to imagine A

Security was absolutely considered during the design process of Windows and iOS. I'm less familiar with AWS and Linux history but it's hard for me to imagine AWS wasn't designed with security in mind given a lack of security would mean people freeloading off of Amazon's servers and security was hardly an unknown subject at the time of AWS's design. One of the main selling points of Windows NT when it was released was per-object ACLs. Windows NT was designed to be sold by the government and military, Dave Cutler wasn't oblivious to the fact that the OS would need to have security in order to get lucrative government contracts. So I'm not really sure how "Just consider security during the design process" is going to save us given all the wildly insecure systems we have where security was considered during the design process. I also don't see Microsoft releasing "Securedows" and replacing Windows, I see any such potential Greenfield secure system as being a specialised product with limited performance/functionality for high security applications which will complement low security systems. Also as passé as the concept is, you really can get a fair degree of security by just disconnecting servers from the internet because few hackers are willing to travel halfway across the world and sneak into a building to infiltrate a network. We're probably never going to able to run nuclear missile silo's out of AWS even if they redesign it from the ground up.

Veserv 4y ago
Microsoft has continuously attempted and failed over multiple decades to get Windows NT of any flavor or configuration certified against anything more stringent than EAL4+ which is not even certified to protect against attackers with a "Moderate" attack potential. A older version of the standard prefaced EAL4 as being limited to protecting against "casual and inadvertent threats". That does not, by any measure, qualify as a vote of confidence in the security of the product. Under the old Orange Book standard EAL4 would approximately qualify as level C2 as Windows systems contemporaneously certified against both the Orange Book and the Common Criteria were certified at EAL4 and C2 simultaneously. A post-mortem on the Orange Book evaluation criteria [1] clarified that C2 was designed to allow commercial systems with no security to get used to the idea of doing a certification so that they could in the future design a proper system with actual security [2]. To add insult to injury, Microsoft has only ever achieved these levels with stripped-down, hardened versions so they could only achieve such vaunted heights as "protection against attackers with a Enhanced-Basic attack potential" after security configuration. Also note that EAL4 is the level pointed out in the Common Criteria as being the highest level a existing commercial product can be retrofitted to. The standard explicitly points out that to achieve a higher level requires a greenfield redesign with security designed to achieve higher levels from the start (hint hint they added that in because Windows kept failing in their attempts to get their EAL4 quality system certified at EAL5). Maybe you are correct that security was considered during the design process of Windows, but the security designed in is nothing short of a complete and utter joke. No security professional of any competence at designing systems that can actually protect against skilled adversaries would stand behind their security pedigree. I mean, for gods sake, even they would not stand behind their own security pedigree; find me one person on the Windows development team who would dare declare that Windows can survive against a NSA penetration test. It is laughable just thinking about it. As for their ability to sell to the government. The total incompetence of the entire commercial IT world is so complete that under pressure to allow COTS vendors to make billion dollar deals with the government the procurement standards were lowered to allow EAL4 systems in high security contexts (as long as they were never connected to the internet, thank god for small wins). It has actually regressed even further in the recent years as in recent years they lowered the standards further to allow commercial firewalls and antivirus systems which are generally only certified to EAL2 under the swiss-cheese theory where if you just stack enough systems with egregious holes together then the system will be secure. We can see how that is working out. It is now to the point where now they just allow anything that is "certified" at any level. That every commercial IT system is at best EAL4 quality is part of the reason why everything is so horribly vulnerable these days. The world runs on systems certified to absolutely not protect against "moderate" threats. To rise above that we must use systems that are designed for real security from the start as we have already seen from history that none of the existing systems can be retrofitted to do so. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an... [2] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an... Page 6, Column 2
- weirdman 4y ago
  You sure put a lot of stock in these bureaucratic certifications. I agree modern OS’s are woefully insecure, but focusing on the certifications the way you do is putting the cart before the horse. Certifications are just some other org’s opinion. Hard to take them seriously when they haven’t built anything so great themselves. Following their list of rules isn’t going to change anything.
  - Veserv 4y ago
    I do, in fact, put stock in quality certifications. Most certifications are not worth the toilet paper they are written on; anything that gives a system as insecure as Windows top scores is obviously useless. In contrast, the best that Windows can certify against with respect to the Common Criteria is that it can verify that it is easily hacked by minimally skilled attackers which has been proven out in practice as true. That is a good sign of a security certification with standards, though by no means exhaustive. You will find that all the certifications you are aware of, which has led you to the idea that all certifications are worthless, fall into this bad category since the commercial IT world is hopelessly incompetent with respect to security and their certifications are the corrupt supporting the corrupt. The standards and prescriptions they suggest are worthless as you state because they have not built anything great, have never seen a great system, and have no intention of creating acceptance criteria that their own incompetently designed systems would fail. Frankly, the number of security standards of any value is basically 0. This does not mean that certifications created by entities that have never built the system they are trying to certify are useless. It is actually quite easy to create excellent acceptance criteria as long as you stray far enough away from prescriptive standards and accept based on the outcomes instead of mechanism. For instance, I am not a mechanical engineer, but I can design the acceptance criteria for a bridge as requiring 3x the maximum weight of fully loaded vehicles laid across the length of the bridge. I do not need to know how that is achieved, just that you must do so before I accept the bridge. Assuming such a standard is desirable (I am not a mechanical engineer so I do not know how bridge load specifications are actually done or what they must achieve), I created a fairly good standard with a acceptance test despite having no knowledge of how the bridge must be built. In fact, I can do this even if such a bridge can not be built with existing technology. In that case we have deemed that a adequate bridge with the desired safety properties is just plain impossible and should not be built. In the case of the Common Criteria SKPP standard, one of the acceptance tests was that the NSA red-team must fail to find any deficiencies. Yes, the literal standard requires that the NSA be unable to hack it and it is verified by the NSA having a team attempt to hack it with full access to the source code, specifications, and proofs of correctness. Now for anybody whose gut instinct is that they will just pretend to fail (which is totally the right gut instinct to have), the NSA did the verification work for the only certified system, INTEGRITY-178B, at the behest of the DoD to verify that the core OS of the F-22 and the F-35, the top-line fighter jets of the US military, can not be hacked and either disabled or turned against the US by enemy countries. This is also the same system used in the flight and weapons control of the B-1 and B-2 intercontinental nuclear bombers and in various other NSA and DoD systems. So, pretending to fail is just shooting themselves, the US Air Force, and part of the US nuclear arsenal in the foot. So yeah, go find me one of these uncertified systems that has achieved a "major advance in security" that the NSA can not hack and then we can start talking about whether there might be some good lessons to be learned. Until then we should probably look to the systems that can actually stop the prevailing threats in practice which the commercial IT sector thinks is literally impossible (that being protecting against nation-state attackers such as the NSA).
notfed 4y ago
All of those OSes are written in C, C++ and sputterings of asm.
- t-3 4y ago
  The entire point of an OS is to handle low level unsafe stuff so the user doesn't have to. Writing in a lower level language doesn't just make sense, it's straight up necessary. Rust is the only "modern" language that's anywhere near the stability and maturity required, but it's still quite young and rough.
  - Yoric 4y ago
    As a note, there are a few other languages that might get there eventually, including Zig and Circle.
  - notfed 4y ago
    Totally agree that a low level language is necessary, but my point was that memory-unsafe languages are not necessary, which it seems you agree since you mentioned Rust as a candidate.

Veserv 4y ago

Microsoft has continuously attempted and failed over multiple decades to get Windows NT of any flavor or configuration certified against anything more stringent than EAL4+ which is not even certified to protect against attackers with a "Moderate" attack potential. A older version of the standard prefaced EAL4 as being limited to protecting against "casual and inadvertent threats". That does not, by any measure, qualify as a vote of confidence in the security of the product. Under the old Orange Book standard EAL4 would approximately qualify as level C2 as Windows systems contemporaneously certified against both the Orange Book and the Common Criteria were certified at EAL4 and C2 simultaneously. A post-mortem on the Orange Book evaluation criteria [1] clarified that C2 was designed to allow commercial systems with no security to get used to the idea of doing a certification so that they could in the future design a proper system with actual security [2]. To add insult to injury, Microsoft has only ever achieved these levels with stripped-down, hardened versions so they could only achieve such vaunted heights as "protection against attackers with a Enhanced-Basic attack potential" after security configuration. Also note that EAL4 is the level pointed out in the Common Criteria as being the highest level a existing commercial product can be retrofitted to. The standard explicitly points out that to achieve a higher level requires a greenfield redesign with security designed to achieve higher levels from the start (hint hint they added that in because Windows kept failing in their attempts to get their EAL4 quality system certified at EAL5). Maybe you are correct that security was considered during the design process of Windows, but the security designed in is nothing short of a complete and utter joke. No security professional of any competence at designing systems that can actually protect against skilled adversaries would stand behind their security pedigree. I mean, for gods sake, even they would not stand behind their own security pedigree; find me one person on the Windows development team who would dare declare that Windows can survive against a NSA penetration test. It is laughable just thinking about it. As for their ability to sell to the government. The total incompetence of the entire commercial IT world is so complete that under pressure to allow COTS vendors to make billion dollar deals with the government the procurement standards were lowered to allow EAL4 systems in high security contexts (as long as they were never connected to the internet, thank god for small wins). It has actually regressed even further in the recent years as in recent years they lowered the standards further to allow commercial firewalls and antivirus systems which are generally only certified to EAL2 under the swiss-cheese theory where if you just stack enough systems with egregious holes together then the system will be secure. We can see how that is working out. It is now to the point where now they just allow anything that is "certified" at any level. That every commercial IT system is at best EAL4 quality is part of the reason why everything is so horribly vulnerable these days. The world runs on systems certified to absolutely not protect against "moderate" threats. To rise above that we must use systems that are designed for real security from the start as we have already seen from history that none of the existing systems can be retrofitted to do so. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an... [2] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an... Page 6, Column 2

weirdman 4y ago
You sure put a lot of stock in these bureaucratic certifications. I agree modern OS’s are woefully insecure, but focusing on the certifications the way you do is putting the cart before the horse. Certifications are just some other org’s opinion. Hard to take them seriously when they haven’t built anything so great themselves. Following their list of rules isn’t going to change anything.
- Veserv 4y ago
  I do, in fact, put stock in quality certifications. Most certifications are not worth the toilet paper they are written on; anything that gives a system as insecure as Windows top scores is obviously useless. In contrast, the best that Windows can certify against with respect to the Common Criteria is that it can verify that it is easily hacked by minimally skilled attackers which has been proven out in practice as true. That is a good sign of a security certification with standards, though by no means exhaustive. You will find that all the certifications you are aware of, which has led you to the idea that all certifications are worthless, fall into this bad category since the commercial IT world is hopelessly incompetent with respect to security and their certifications are the corrupt supporting the corrupt. The standards and prescriptions they suggest are worthless as you state because they have not built anything great, have never seen a great system, and have no intention of creating acceptance criteria that their own incompetently designed systems would fail. Frankly, the number of security standards of any value is basically 0. This does not mean that certifications created by entities that have never built the system they are trying to certify are useless. It is actually quite easy to create excellent acceptance criteria as long as you stray far enough away from prescriptive standards and accept based on the outcomes instead of mechanism. For instance, I am not a mechanical engineer, but I can design the acceptance criteria for a bridge as requiring 3x the maximum weight of fully loaded vehicles laid across the length of the bridge. I do not need to know how that is achieved, just that you must do so before I accept the bridge. Assuming such a standard is desirable (I am not a mechanical engineer so I do not know how bridge load specifications are actually done or what they must achieve), I created a fairly good standard with a acceptance test despite having no knowledge of how the bridge must be built. In fact, I can do this even if such a bridge can not be built with existing technology. In that case we have deemed that a adequate bridge with the desired safety properties is just plain impossible and should not be built. In the case of the Common Criteria SKPP standard, one of the acceptance tests was that the NSA red-team must fail to find any deficiencies. Yes, the literal standard requires that the NSA be unable to hack it and it is verified by the NSA having a team attempt to hack it with full access to the source code, specifications, and proofs of correctness. Now for anybody whose gut instinct is that they will just pretend to fail (which is totally the right gut instinct to have), the NSA did the verification work for the only certified system, INTEGRITY-178B, at the behest of the DoD to verify that the core OS of the F-22 and the F-35, the top-line fighter jets of the US military, can not be hacked and either disabled or turned against the US by enemy countries. This is also the same system used in the flight and weapons control of the B-1 and B-2 intercontinental nuclear bombers and in various other NSA and DoD systems. So, pretending to fail is just shooting themselves, the US Air Force, and part of the US nuclear arsenal in the foot. So yeah, go find me one of these uncertified systems that has achieved a "major advance in security" that the NSA can not hack and then we can start talking about whether there might be some good lessons to be learned. Until then we should probably look to the systems that can actually stop the prevailing threats in practice which the commercial IT sector thinks is literally impossible (that being protecting against nation-state attackers such as the NSA).

notfed 4y ago

All of those OSes are written in C, C++ and sputterings of asm.

t-3 4y ago
The entire point of an OS is to handle low level unsafe stuff so the user doesn't have to. Writing in a lower level language doesn't just make sense, it's straight up necessary. Rust is the only "modern" language that's anywhere near the stability and maturity required, but it's still quite young and rough.
- Yoric 4y ago
  As a note, there are a few other languages that might get there eventually, including Zig and Circle.
- notfed 4y ago
  Totally agree that a low level language is necessary, but my point was that memory-unsafe languages are not necessary, which it seems you agree since you mentioned Rust as a candidate.