3 ms·

Now, granted that the idea of an unconnected computer might be utterly foreign to the younger generations in an era of absolute interconnectivity. I'm not sure

Now, granted that the idea of an unconnected computer might be utterly foreign to the younger generations in an era of absolute interconnectivity. I'm not sure if I should be amused or horrified that people in this thread don't seem to understand what an air gapped computer is.

cangeroo 3y ago
It's when you turn on flight mode, right? /s (You have to physically remove the wifi and bluetooth hardware) Also, one-way diodes are fine, mostly. But I agree completely. There's a major lack of awareness. I'm quite angry that firewalls on phones isn't a thing - and that you have to use a VPN workaround. Why is such a basic feature missing? (Oh wait, I know: advertising revenue, and uh, intentional vulnerability)
- fsflover 3y ago
  You can use a firewall on GNU/Linux phones though.
  - 1oooqooq 3y ago
    except there's no such phones. there's no pure linux even on the main cpu, let alone in the entire device with separate computers for radio, camera, lowpower mode, etc.
    - fsflover 3y ago
      Sending this message from my Librem 5 used as a daily driver, https://en.wikipedia.org/wiki/Librem_5 https://en.wikipedia.org/wiki/Librem_5.
      - 1oooqooq 3y ago
        yeah. that's the least worse. but still much worse than even x86, which is already questionable but accepted as ok. nothing on that SoC is free or open. btw, misleading everyone by running the blobs in a separate core with the same accesses of the main ones just to brute force certification is even worse than admitting you couldn't get free of the blobs, like the pine phone people correctly did.
        fsflover 3y ago
        > with the same accesses of the main ones Could you provide any links or details?
        1oooqooq 3y ago
        Same access to most of the buses. unless you keep all your secrets in one core registers and maybe local caches. anyway, I wouldn't know. nothing from those cores is open besides the ARM abi it is built based on.
        yjftsjthsd-h 3y ago
        That's moving the goalposts; we started at > You can use a firewall on GNU/Linux phones though. And that's true. There are phones, that run GNU/Linux distros, that give you a working software firewall. Pointing at blobs doesn't make it not GNU/Linux on a phone with a firewall. At best it points to a place where a firewall could be undermined, but if that's your standard then (nearly?) everything fails, including actual literal firewall hardware appliances (I'd take Linux nftables on a blobbed network card over Cisco any day).
        1oooqooq 3y ago
        > including literal firewall hardware appliances Correct, and not getting why that is the worse of the options puts you out of the discussion in this thread. sorry.
greggsy 3y ago
This thread is obsessed with nit picking this point. They cite that it removes the need for an air gapped system… They’re not claiming that it is one, just that it meets the requirements for their needs. Also, since when was the concept of an air gap a one that only the vaunted druids of old could fathom?
- Dalewyn 3y ago
  Alright, you don't understand air gapping so hard it's actually dangerous (to other readers, not you; I don't care if your ignorance burns you), so let's go over why the hell this lack of understanding is horrifying. 1. If you need an air gapped computer, your threat model includes literally any electrical wire connecting to the outside world. 2. If you need an air gapped computer, your threat model includes literally any radio signal. With this in mind, there is no way in fucking hell that a virtual machine can satisfy your requirements. That virtual machine literally resides on the same fucking wires as the host computer, this is even worse than a wire connecting two computers. The Guardian is a media outlet, their job description is receiving information from sources securely. Some of that information will be extremely high value, like "the wrong people seeing this will lead to murders" extremely high value. Handling that kind of sensitive information absolutely requires air gapping to minimize your attack surface as much as humanly possible. Note humanly possible, not reasonably possible; reasonable isn't enough. A properly air gapped computer is going to use as few physical connections to the outside world as possible. It will also be shielded from all radio signals. The only way to access it is a physical human moving from the outside world to secured space in which the air gapped computer resides. If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
  - fsflover 3y ago
    How do you suggest to prevent badUSB attack with air-gapping?
    - Dalewyn 3y ago
      By prohibiting the carriage of USB media or only allowing ones which are under strict and constant supervision and lockdown, not to mention locking down any USB ports on the computer itself both physically and in software. An air gap means there are physical barriers that are locked down (you are installing physical barriers and locking them down, right?), which means you can inspect anyone and anything trying to traverse it and prohibit anyone and anything that is even remotely suspect. The fact you are even asking this demonstrates you (by far the most vocal of the "Qubes is enough" crowd here) don't understand air gapping.

cangeroo 3y ago

It's when you turn on flight mode, right? /s (You have to physically remove the wifi and bluetooth hardware) Also, one-way diodes are fine, mostly. But I agree completely. There's a major lack of awareness. I'm quite angry that firewalls on phones isn't a thing - and that you have to use a VPN workaround. Why is such a basic feature missing? (Oh wait, I know: advertising revenue, and uh, intentional vulnerability)

fsflover 3y ago
You can use a firewall on GNU/Linux phones though.
- 1oooqooq 3y ago
  except there's no such phones. there's no pure linux even on the main cpu, let alone in the entire device with separate computers for radio, camera, lowpower mode, etc.
  - fsflover 3y ago
    Sending this message from my Librem 5 used as a daily driver, https://en.wikipedia.org/wiki/Librem_5 https://en.wikipedia.org/wiki/Librem_5.
    - 1oooqooq 3y ago
      yeah. that's the least worse. but still much worse than even x86, which is already questionable but accepted as ok. nothing on that SoC is free or open. btw, misleading everyone by running the blobs in a separate core with the same accesses of the main ones just to brute force certification is even worse than admitting you couldn't get free of the blobs, like the pine phone people correctly did.
      - fsflover 3y ago
        > with the same accesses of the main ones Could you provide any links or details?
        1oooqooq 3y ago
        Same access to most of the buses. unless you keep all your secrets in one core registers and maybe local caches. anyway, I wouldn't know. nothing from those cores is open besides the ARM abi it is built based on.
      - yjftsjthsd-h 3y ago
        That's moving the goalposts; we started at > You can use a firewall on GNU/Linux phones though. And that's true. There are phones, that run GNU/Linux distros, that give you a working software firewall. Pointing at blobs doesn't make it not GNU/Linux on a phone with a firewall. At best it points to a place where a firewall could be undermined, but if that's your standard then (nearly?) everything fails, including actual literal firewall hardware appliances (I'd take Linux nftables on a blobbed network card over Cisco any day).
        1oooqooq 3y ago
        > including literal firewall hardware appliances Correct, and not getting why that is the worse of the options puts you out of the discussion in this thread. sorry.

greggsy 3y ago

This thread is obsessed with nit picking this point. They cite that it removes the need for an air gapped system… They’re not claiming that it is one, just that it meets the requirements for their needs. Also, since when was the concept of an air gap a one that only the vaunted druids of old could fathom?

Dalewyn 3y ago
Alright, you don't understand air gapping so hard it's actually dangerous (to other readers, not you; I don't care if your ignorance burns you), so let's go over why the hell this lack of understanding is horrifying. 1. If you need an air gapped computer, your threat model includes literally any electrical wire connecting to the outside world. 2. If you need an air gapped computer, your threat model includes literally any radio signal. With this in mind, there is no way in fucking hell that a virtual machine can satisfy your requirements. That virtual machine literally resides on the same fucking wires as the host computer, this is even worse than a wire connecting two computers. The Guardian is a media outlet, their job description is receiving information from sources securely. Some of that information will be extremely high value, like "the wrong people seeing this will lead to murders" extremely high value. Handling that kind of sensitive information absolutely requires air gapping to minimize your attack surface as much as humanly possible. Note humanly possible, not reasonably possible; reasonable isn't enough. A properly air gapped computer is going to use as few physical connections to the outside world as possible. It will also be shielded from all radio signals. The only way to access it is a physical human moving from the outside world to secured space in which the air gapped computer resides. If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
- fsflover 3y ago
  How do you suggest to prevent badUSB attack with air-gapping?
  - Dalewyn 3y ago
    By prohibiting the carriage of USB media or only allowing ones which are under strict and constant supervision and lockdown, not to mention locking down any USB ports on the computer itself both physically and in software. An air gap means there are physical barriers that are locked down (you are installing physical barriers and locking them down, right?), which means you can inspect anyone and anything trying to traverse it and prohibit anyone and anything that is even remotely suspect. The fact you are even asking this demonstrates you (by far the most vocal of the "Qubes is enough" crowd here) don't understand air gapping.