5 ms·

Trusting Trust: Ken Thompson on supply chain security (1984)

49 points by brianzelip 3y ago

willis936 3y ago
I first learned of this from the computerphile video. https://youtu.be/SJ7lOus1FzQ https://youtu.be/SJ7lOus1FzQ
4ad 3y ago
Obligatory: https://dwheeler.com/trusting-trust https://dwheeler.com/trusting-trust.
wiz21c 3y ago
FTA: "I have watched kids testifying before Congress. It is clear that they are completely unaware of the serious- ness of their acts. There is obViously a cultural gap. The act of breaking into a computer system has to have the same social stigma as breaking into a neighbor's house." I've got mixed feelings about this. I loved the WarGame movie for a reason...
- diggan 3y ago
  Worth noting that this was from 1984 in a society that looked very different than today. I'm not sure how Ken Thompson feels about the current climate, but judging by the harsh punishments that are being handed out for computer crimes, I think we've swung the pendulum far too much in the direction Thompson argued for here. United States v. Swartz comes to mind, where Swartz was facing up to 35 years in prison downloading academic journal articles.
  - __MatrixMan__ 3y ago
    Schwartz was being made an example of (and it's a tragedy, no doubt) but it was more about certain parties flexing their influence over the legal system than it was cultural attitudes about computer access. If you stoped a random on the street and asked them about how Swartz should be punished, you might have a hard time convincing them that what he did was a crime at all. I don't think it's a well defined pendulum anymore. Our computer systems used to be little hermetically sealed boxes where network activity was the exception, not the rule. "Breaking in" was a rather well defined thing. Things are different now. The modern web would look to people in the 80's like one giant remote code execution exploit. There are so many cases where commonly used apps phone home for updates and instructions (and for some reason, we're ok with this). Last time I installed Windows it tried to get me to set up a Microsoft account which I could use to manage it. Unless you've taken steps to opt out of this, your device isn't so much "your" device as it is the part of the vendor's fleet of devices which happens to be assigned to you. Betrayals of trust still happen, and they're still serious, but "unauthorized entry" is an outmoded way of thinking about them.
    - axus 3y ago
      Was their influence over the legal system due to the amount of money they could spend, or something else?
      - __MatrixMan__ 3y ago
        I'm guessing it was the former, but I'm not sure. There's plenty of blame to assign them without needing to reach for corruption.
- jollyllama 3y ago
  It doesn't really hold water. In what world did kids who walked into unlocked houses get prison terms for years?
  - ninth_ant 3y ago
    The quote directly says “breaking in” which is at odds with your usage of “unlocked” Poor security in some computer systems doesn’t equal unlocked - in the physical world many locks can be quickly unlocked by someone with only moderate training.
    - IggleSniggle 3y ago
      Does having the right public (but unadvertised) URL count as being unlocked or as having the key to unlock a locked door? I doubt most would say that having an address is the same as having the keys, but it's plausible that it could be seen this way. By that same token, if you put your keys in your mailbox but the door is locked, it does seem different for a kid to enter that door vs a totally unlocked door, even though anybody could do it easily. The locked door is a signal, "this is not meant to be public." I guess this is why we have judges, though. To make judgments.
      - jraph 3y ago
        > Does having the right public (but unadvertised) URL count as being unlocked or as having the key to unlock a locked door? It depends on what you call public. URLs sometimes contain keys, for example Nextcloud shares or CryptPad documents. Or Jitsi Meet rooms (and virtually all videoconferencing system for that matter). > I guess this is why we have judges, though. To make judgments. Absolutely. I also think that we should not really try to view this stuff in technical terms, but rather in terms of intent. Is the thing we are considering obviously not supposed to be public? Now, regarding Aaron Swartz, I do think civil disobedience is an important thing, and that public research should be public. It sounds so tautological it almost feels stupid to say it.
    - jollyllama 3y ago
      It's not, because the next sentence is: "It should not matter that the neighbor's door is unlocked."
- jerf 3y ago
  If you want to be a l33t haxx0r, break into these: https://www.vulnhub.com/ https://www.vulnhub.com/ and see https://www.vulnhub.com/about/ https://www.vulnhub.com/about/ Educational. Legal. Most of the fun with none of the risk. We no longer have a need to romanticize hacking real computers.
  - lupire 3y ago
    The fun is in breaking the rules, not learning the software.
    - jerf 3y ago
      That varies from person to person. If your idea of fun is breaking rules, for any purpose you can name there are probably better rules to break. Though you'll forgive me if I don't sit here and start listing them. But at the very least, if this is what you want to do, get hired by an intelligence agency and do it under their aegis and protection. Freelancing in this domain has become all sorts of bad idea.
      - randomdata 3y ago
        > there are probably better rules to break. No need to limit yourself. You can break other rules too, quite likely at the same time.
  - __MatrixMan__ 3y ago
    We still have a need to romanticize standing up against the powerful when they misbehave--even when it's illegal to do so. Hacking real computers is still a means to that end.
- couchand 3y ago
  Particularly after basically giving a pass to the companies for not prioritizing security!
- lupire 3y ago
  Breaking into a government computer should have the same stigma as breaking into the government building.
- randomdata 3y ago
  Thing is, there is breaking in and there is letting you in. To stick with the analogy, "go on in, the door is unlocked" was accepted in the neighbourhood I grew up in. When is a computer broken into and when is it left unlocked?
deleted 3y ago
[deleted]

49 points by brianzelip 3y ago

willis936 3y ago

I first learned of this from the computerphile video. https://youtu.be/SJ7lOus1FzQ https://youtu.be/SJ7lOus1FzQ

4ad 3y ago

Obligatory: https://dwheeler.com/trusting-trust https://dwheeler.com/trusting-trust.

wiz21c 3y ago

FTA: "I have watched kids testifying before Congress. It is clear that they are completely unaware of the serious- ness of their acts. There is obViously a cultural gap. The act of breaking into a computer system has to have the same social stigma as breaking into a neighbor's house." I've got mixed feelings about this. I loved the WarGame movie for a reason...

diggan 3y ago
Worth noting that this was from 1984 in a society that looked very different than today. I'm not sure how Ken Thompson feels about the current climate, but judging by the harsh punishments that are being handed out for computer crimes, I think we've swung the pendulum far too much in the direction Thompson argued for here. United States v. Swartz comes to mind, where Swartz was facing up to 35 years in prison downloading academic journal articles.
- __MatrixMan__ 3y ago
  Schwartz was being made an example of (and it's a tragedy, no doubt) but it was more about certain parties flexing their influence over the legal system than it was cultural attitudes about computer access. If you stoped a random on the street and asked them about how Swartz should be punished, you might have a hard time convincing them that what he did was a crime at all. I don't think it's a well defined pendulum anymore. Our computer systems used to be little hermetically sealed boxes where network activity was the exception, not the rule. "Breaking in" was a rather well defined thing. Things are different now. The modern web would look to people in the 80's like one giant remote code execution exploit. There are so many cases where commonly used apps phone home for updates and instructions (and for some reason, we're ok with this). Last time I installed Windows it tried to get me to set up a Microsoft account which I could use to manage it. Unless you've taken steps to opt out of this, your device isn't so much "your" device as it is the part of the vendor's fleet of devices which happens to be assigned to you. Betrayals of trust still happen, and they're still serious, but "unauthorized entry" is an outmoded way of thinking about them.
  - axus 3y ago
    Was their influence over the legal system due to the amount of money they could spend, or something else?
    - __MatrixMan__ 3y ago
      I'm guessing it was the former, but I'm not sure. There's plenty of blame to assign them without needing to reach for corruption.
jollyllama 3y ago
It doesn't really hold water. In what world did kids who walked into unlocked houses get prison terms for years?
- ninth_ant 3y ago
  The quote directly says “breaking in” which is at odds with your usage of “unlocked” Poor security in some computer systems doesn’t equal unlocked - in the physical world many locks can be quickly unlocked by someone with only moderate training.
  - IggleSniggle 3y ago
    Does having the right public (but unadvertised) URL count as being unlocked or as having the key to unlock a locked door? I doubt most would say that having an address is the same as having the keys, but it's plausible that it could be seen this way. By that same token, if you put your keys in your mailbox but the door is locked, it does seem different for a kid to enter that door vs a totally unlocked door, even though anybody could do it easily. The locked door is a signal, "this is not meant to be public." I guess this is why we have judges, though. To make judgments.
    - jraph 3y ago
      > Does having the right public (but unadvertised) URL count as being unlocked or as having the key to unlock a locked door? It depends on what you call public. URLs sometimes contain keys, for example Nextcloud shares or CryptPad documents. Or Jitsi Meet rooms (and virtually all videoconferencing system for that matter). > I guess this is why we have judges, though. To make judgments. Absolutely. I also think that we should not really try to view this stuff in technical terms, but rather in terms of intent. Is the thing we are considering obviously not supposed to be public? Now, regarding Aaron Swartz, I do think civil disobedience is an important thing, and that public research should be public. It sounds so tautological it almost feels stupid to say it.
  - jollyllama 3y ago
    It's not, because the next sentence is: "It should not matter that the neighbor's door is unlocked."
jerf 3y ago
If you want to be a l33t haxx0r, break into these: https://www.vulnhub.com/ https://www.vulnhub.com/ and see https://www.vulnhub.com/about/ https://www.vulnhub.com/about/ Educational. Legal. Most of the fun with none of the risk. We no longer have a need to romanticize hacking real computers.
- lupire 3y ago
  The fun is in breaking the rules, not learning the software.
  - jerf 3y ago
    That varies from person to person. If your idea of fun is breaking rules, for any purpose you can name there are probably better rules to break. Though you'll forgive me if I don't sit here and start listing them. But at the very least, if this is what you want to do, get hired by an intelligence agency and do it under their aegis and protection. Freelancing in this domain has become all sorts of bad idea.
    - randomdata 3y ago
      > there are probably better rules to break. No need to limit yourself. You can break other rules too, quite likely at the same time.
- __MatrixMan__ 3y ago
  We still have a need to romanticize standing up against the powerful when they misbehave--even when it's illegal to do so. Hacking real computers is still a means to that end.
couchand 3y ago
Particularly after basically giving a pass to the companies for not prioritizing security!
lupire 3y ago
Breaking into a government computer should have the same stigma as breaking into the government building.
randomdata 3y ago
Thing is, there is breaking in and there is letting you in. To stick with the analogy, "go on in, the door is unlocked" was accepted in the neighbourhood I grew up in. When is a computer broken into and when is it left unlocked?

deleted 3y ago

[deleted]