3 ms·

Maybe it should be safe to say? but do they actually have a diagram of their physical and logical setup that shows they use bare metal only and not VM's or cont

Maybe it should be safe to say? but do they actually have a diagram of their physical and logical setup that shows they use bare metal only and not VM's or containers? Is that documented in audited security controls?

dijit 3y ago
Such a weird discussion because we're talking about a company that is going from the very fundamentals of operating system design and the boot process of bare metal machines in order to get more security. It's very antithetical to that goal to add more layers of abstraction that could be buggy or reduce security. We're talking about motivated and intelligent people purposefully trading off convenience for security. Containers, btw, cannot be snapshotted. So that's a weird thing to put into your question. They've also discussed booting UEFI directly to VPN nodes: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... It's completely weird to argue that they might introduce a layer of insecurity here. Directly goes against everything else they're working on.
- kaszanka 3y ago
  > Containers, btw, cannot be snapshotted Why not?
  - anonacct37 3y ago
    criu has been used for live migration for a while. Getting a consistent snapshot that you can restore reliably is a hard problem but probably not as big deal for forensic analysis.
- LinuxBender 3y ago
  Such a weird discussion because we're talking about a company that is going from the very fundamentals of operating system design and the boot process of bare metal machines in order to get more security. I am extra skeptical of a company that pushes this. They and I know they can't side step lawful requests which raises the spidey senses even further so I believe it is a valid question. Containers, btw, cannot be snapshotted. I did not say they could be. Their memory contents however can be accessed, even if the host memory is encrypted. They've also discussed booting UEFI directly to VPN nodes: That in no way precludes having VM's. I have run VM's on PXE Diskless nodes. The boot method is orthogonal to this. It's completely weird to argue that they might introduce a layer of insecurity here. Weird maybe? But completely logical and valid question nonetheless. They are leaving 53 characters out of their documentation unless I missed it. My questions could be solved by saying "We do not any form of virtual machines or containers". That is only 53 characters and should fit on their document site.
  - ziddoap 3y ago
    >They and I know they can't side step lawful requests which raises the spidey senses even further so I believe it is a valid question. They have been able to turn down lawful requests previously, which is (at the very least) a positive indicator that may lower your spidey senses a bit. >On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. >After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information. https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
    - LinuxBender 3y ago
      I remember that and that case was cool. I will leave my questions in place though because I recall Apple doing the same thing when a terrorist phone was locked and they claimed to not be able to access with a big public show/fight it but turns out they could and so could the FBI. My theory is that they did not want the public to lose confidence in their phones.
      - hathawsh 3y ago
        Yeah, that Apple case was really interesting. I always guessed that Apple could simply push a software update (possibly to everyone) that happens to open a backdoor for a specific phone. I wonder if that's what they did.
        asynchronous 3y ago
        What happened in that case is the FBI went to a different vendor, and they broke into the iPhone either with a zero day they had developed or more likely, they just cloned the phone hardware thousands of times until they could guess the password.
        3y ago
- wolfgang42 3y ago
  > Containers, btw, cannot be snapshotted. lxc-snapshot(1), podman-container-checkpoint(1), and docker-checkpoint-create(1) all beg to differ.
  - rzzzt 3y ago
    Some (maybe all) of these are backed by CRIU: https://criu.org/Main_Page https://criu.org/Main_Page
    - paulddraper 3y ago
      Docker at least is
- Ms-J 3y ago
  I think it's a very rational question to ask. Is Mullvad using only bare-metal infrastructure, or is there any logical abstractions added to the servers? Companies make statements all the time which can be twisted to their benefit, but read exactly like what a customer is after. I'm not stating Mullvad does or doesn't do this, btw.
tiagod 3y ago
Even if they did... if mullvad was a honeypot, there is nothing that would stop them from posting a fake diagram.

dijit 3y ago

Such a weird discussion because we're talking about a company that is going from the very fundamentals of operating system design and the boot process of bare metal machines in order to get more security. It's very antithetical to that goal to add more layers of abstraction that could be buggy or reduce security. We're talking about motivated and intelligent people purposefully trading off convenience for security. Containers, btw, cannot be snapshotted. So that's a weird thing to put into your question. They've also discussed booting UEFI directly to VPN nodes: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... It's completely weird to argue that they might introduce a layer of insecurity here. Directly goes against everything else they're working on.

kaszanka 3y ago
> Containers, btw, cannot be snapshotted Why not?
- anonacct37 3y ago
  criu has been used for live migration for a while. Getting a consistent snapshot that you can restore reliably is a hard problem but probably not as big deal for forensic analysis.
LinuxBender 3y ago
Such a weird discussion because we're talking about a company that is going from the very fundamentals of operating system design and the boot process of bare metal machines in order to get more security. I am extra skeptical of a company that pushes this. They and I know they can't side step lawful requests which raises the spidey senses even further so I believe it is a valid question. Containers, btw, cannot be snapshotted. I did not say they could be. Their memory contents however can be accessed, even if the host memory is encrypted. They've also discussed booting UEFI directly to VPN nodes: That in no way precludes having VM's. I have run VM's on PXE Diskless nodes. The boot method is orthogonal to this. It's completely weird to argue that they might introduce a layer of insecurity here. Weird maybe? But completely logical and valid question nonetheless. They are leaving 53 characters out of their documentation unless I missed it. My questions could be solved by saying "We do not any form of virtual machines or containers". That is only 53 characters and should fit on their document site.
- ziddoap 3y ago
  >They and I know they can't side step lawful requests which raises the spidey senses even further so I believe it is a valid question. They have been able to turn down lawful requests previously, which is (at the very least) a positive indicator that may lower your spidey senses a bit. >On April 18 at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. >After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information. https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
  - LinuxBender 3y ago
    I remember that and that case was cool. I will leave my questions in place though because I recall Apple doing the same thing when a terrorist phone was locked and they claimed to not be able to access with a big public show/fight it but turns out they could and so could the FBI. My theory is that they did not want the public to lose confidence in their phones.
    - hathawsh 3y ago
      Yeah, that Apple case was really interesting. I always guessed that Apple could simply push a software update (possibly to everyone) that happens to open a backdoor for a specific phone. I wonder if that's what they did.
      - asynchronous 3y ago
        What happened in that case is the FBI went to a different vendor, and they broke into the iPhone either with a zero day they had developed or more likely, they just cloned the phone hardware thousands of times until they could guess the password.
        3y ago
wolfgang42 3y ago
> Containers, btw, cannot be snapshotted. lxc-snapshot(1), podman-container-checkpoint(1), and docker-checkpoint-create(1) all beg to differ.
- rzzzt 3y ago
  Some (maybe all) of these are backed by CRIU: https://criu.org/Main_Page https://criu.org/Main_Page
  - paulddraper 3y ago
    Docker at least is
Ms-J 3y ago
I think it's a very rational question to ask. Is Mullvad using only bare-metal infrastructure, or is there any logical abstractions added to the servers? Companies make statements all the time which can be twisted to their benefit, but read exactly like what a customer is after. I'm not stating Mullvad does or doesn't do this, btw.

tiagod 3y ago

Even if they did... if mullvad was a honeypot, there is nothing that would stop them from posting a fake diagram.