11 ms·

This thread is obsessed with nit picking this point. They cite that it removes the need for an air gapped system… They’re not claiming that it is one, just tha

This thread is obsessed with nit picking this point. They cite that it removes the need for an air gapped system… They’re not claiming that it is one, just that it meets the requirements for their needs. Also, since when was the concept of an air gap a one that only the vaunted druids of old could fathom?

Dalewyn 3y ago
Alright, you don't understand air gapping so hard it's actually dangerous (to other readers, not you; I don't care if your ignorance burns you), so let's go over why the hell this lack of understanding is horrifying. 1. If you need an air gapped computer, your threat model includes literally any electrical wire connecting to the outside world. 2. If you need an air gapped computer, your threat model includes literally any radio signal. With this in mind, there is no way in fucking hell that a virtual machine can satisfy your requirements. That virtual machine literally resides on the same fucking wires as the host computer, this is even worse than a wire connecting two computers. The Guardian is a media outlet, their job description is receiving information from sources securely. Some of that information will be extremely high value, like "the wrong people seeing this will lead to murders" extremely high value. Handling that kind of sensitive information absolutely requires air gapping to minimize your attack surface as much as humanly possible. Note humanly possible, not reasonably possible; reasonable isn't enough. A properly air gapped computer is going to use as few physical connections to the outside world as possible. It will also be shielded from all radio signals. The only way to access it is a physical human moving from the outside world to secured space in which the air gapped computer resides. If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
- fsflover 3y ago
  How do you suggest to prevent badUSB attack with air-gapping?
  - Dalewyn 3y ago
    By prohibiting the carriage of USB media or only allowing ones which are under strict and constant supervision and lockdown, not to mention locking down any USB ports on the computer itself both physically and in software. An air gap means there are physical barriers that are locked down (you are installing physical barriers and locking them down, right?), which means you can inspect anyone and anything trying to traverse it and prohibit anyone and anything that is even remotely suspect. The fact you are even asking this demonstrates you (by far the most vocal of the "Qubes is enough" crowd here) don't understand air gapping.
    - fsflover 3y ago
      I do understand air gaping. However I don't understand what you're suggesting to do in practice for The Guardian. Exchange files via QR codes? True air gaping is simply unusable for non-experts. I believe in a reasonable security. In the article, they explain how they made a real, practical step towards a better security. Perfect is the enemy of the good. I also like this reply: https://news.ycombinator.com/item?id=39952028 https://news.ycombinator.com/item?id=39952028
      - Dalewyn 3y ago
        Maybe you're not aware, but The Guardian's job description is obtaining and handling sensitive information. They are experts, ostensibly anyway. Their threat model is rightfully ridiculous and ridiculous threat models require ridiculous security measures such as air gapping which Qubes cannot satisfy. Reasonable is not enough given what they do. EDIT: Maybe these guys aren't experts and don't deserve to receive and handle sensitive information: https://news.ycombinator.com/item?id=39954815 https://news.ycombinator.com/item?id=39954815
  - deleted 3y ago
    [deleted]
- amluto 3y ago
  Those are strange requirements. If I need to prevent exfiltration of one logical machine’s data to another, and I’m in physical control of the hardware running both of them, I can: (a) Try to prevent any electrical, radio, power, acoustic, or other signaling from one to the other, or: (b) Run both in a fully deterministic mode such that the execution of one has no effect on the execution of the other. Both have different costs and their security hinges on different sorts of verification, but it’s not at all clear to me that (a) is inherently better than (b).
  - Dalewyn 3y ago
    >Those are strange requirements. A threat model that necessitates an air gap is indeed a strange one, I daresay even ridiculous. To put it frankly, most people simply will never have to consider such a ridiculous threat model. Being suspicious of everything down to literally the copper wire in your power cord is something most people will rightfully consider ridiculous. For most people, a virtual machine will provide more than ample security for their needs, and it's been mentioned already that Qubes itself is great so nobody is discounting the value there. The problem is we are not talking about normal people. We are talking about highly specific, highly special people handling highly valuable work, dogged by highly powerful hostiles. The very nature of these people and their work is ridiculous, which necessitates considering ridiculous threat models and implementing ridiculous security measures to guard against them. Where someone needs an air gap, replacing that with Qubes is mind bogglingly stupid because to quote karma_pharmer who put it very poignantly[1]: That is not an air gap. [1]: https://news.ycombinator.com/item?id=39951031 https://news.ycombinator.com/item?id=39951031
  - ycombinatrix 3y ago
    Did you even read the comment you're replying to? >If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
    - amluto 3y ago
      I did. There’s a very reasonable threat model in which KVM or Hyper-V or bhyve or Xen is inadequate and an air gap provides stronger protection. But that’s not my point at all. Many uses of computers need to interact with potentially untrustworthy data, and make uses need to interact with untrustworthy transports that carry trusted data. An air gap is of little value if nothing can cross it. (Yes, some sets of threat models and design criteria allow data diodes.) If I had a nation-state budget and wanted to get data across a gap, I would look toward a deterministic, formally verified VM. This is quite practical — a very simple, small VM can run an emulator that can emulate x86 or ARM. And I would also consider an air gap. But keep in mind that an air gap does not protect against persistent compromise of the thing on one side, whereas a formally verified VM does.
- deleted 3y ago
  [deleted]
- greggsy 3y ago
  I know exactly what it is, and you should read my comment.
  - Dalewyn 3y ago
    If you are seriously suggesting a virtual machine is the same thing as an air gap, then no: You do not know what air gapping is. Not the least because there is literally no god damn gap with a virtual machine on a host computer. There is no way to guarantee there will be no unauthorized access or movement of data without a hard, physical gap requiring manual, scrutinized traversal. No amount of software or hardware mitigations can suffice. If Qubes is satisfactory for The Guardian, then they never needed air gapping in the first place. I find that hard to believe given what their job description is, but that is ultimately none of my business (though I won't give them any sensitive information, for the safety of both myself and others). Meanwhile, if you need air gapping then Qubes by itself absolutely cannot satisfy your security needs. Because a virtual machine is not an air gap.
    - jmprspret 3y ago
      > If you are seriously suggesting a virtual machine is the same thing as an air gap You absolutely still have not read their comment.
    - greggsy 3y ago
      I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. If you still disagree, that’s fine, but the fact that you don’t understand the immense burden that a truly air gapped network would have on users and administrators speaks volumes of your own understanding of these types of systems and solutions.
      - Dalewyn 3y ago

Dalewyn 3y ago

Alright, you don't understand air gapping so hard it's actually dangerous (to other readers, not you; I don't care if your ignorance burns you), so let's go over why the hell this lack of understanding is horrifying. 1. If you need an air gapped computer, your threat model includes literally any electrical wire connecting to the outside world. 2. If you need an air gapped computer, your threat model includes literally any radio signal. With this in mind, there is no way in fucking hell that a virtual machine can satisfy your requirements. That virtual machine literally resides on the same fucking wires as the host computer, this is even worse than a wire connecting two computers. The Guardian is a media outlet, their job description is receiving information from sources securely. Some of that information will be extremely high value, like "the wrong people seeing this will lead to murders" extremely high value. Handling that kind of sensitive information absolutely requires air gapping to minimize your attack surface as much as humanly possible. Note humanly possible, not reasonably possible; reasonable isn't enough. A properly air gapped computer is going to use as few physical connections to the outside world as possible. It will also be shielded from all radio signals. The only way to access it is a physical human moving from the outside world to secured space in which the air gapped computer resides. If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.

fsflover 3y ago
How do you suggest to prevent badUSB attack with air-gapping?
- Dalewyn 3y ago
  By prohibiting the carriage of USB media or only allowing ones which are under strict and constant supervision and lockdown, not to mention locking down any USB ports on the computer itself both physically and in software. An air gap means there are physical barriers that are locked down (you are installing physical barriers and locking them down, right?), which means you can inspect anyone and anything trying to traverse it and prohibit anyone and anything that is even remotely suspect. The fact you are even asking this demonstrates you (by far the most vocal of the "Qubes is enough" crowd here) don't understand air gapping.
  - fsflover 3y ago
    I do understand air gaping. However I don't understand what you're suggesting to do in practice for The Guardian. Exchange files via QR codes? True air gaping is simply unusable for non-experts. I believe in a reasonable security. In the article, they explain how they made a real, practical step towards a better security. Perfect is the enemy of the good. I also like this reply: https://news.ycombinator.com/item?id=39952028 https://news.ycombinator.com/item?id=39952028
    - Dalewyn 3y ago
      Maybe you're not aware, but The Guardian's job description is obtaining and handling sensitive information. They are experts, ostensibly anyway. Their threat model is rightfully ridiculous and ridiculous threat models require ridiculous security measures such as air gapping which Qubes cannot satisfy. Reasonable is not enough given what they do. EDIT: Maybe these guys aren't experts and don't deserve to receive and handle sensitive information: https://news.ycombinator.com/item?id=39954815 https://news.ycombinator.com/item?id=39954815
- deleted 3y ago
  [deleted]
amluto 3y ago
Those are strange requirements. If I need to prevent exfiltration of one logical machine’s data to another, and I’m in physical control of the hardware running both of them, I can: (a) Try to prevent any electrical, radio, power, acoustic, or other signaling from one to the other, or: (b) Run both in a fully deterministic mode such that the execution of one has no effect on the execution of the other. Both have different costs and their security hinges on different sorts of verification, but it’s not at all clear to me that (a) is inherently better than (b).
- Dalewyn 3y ago
  >Those are strange requirements. A threat model that necessitates an air gap is indeed a strange one, I daresay even ridiculous. To put it frankly, most people simply will never have to consider such a ridiculous threat model. Being suspicious of everything down to literally the copper wire in your power cord is something most people will rightfully consider ridiculous. For most people, a virtual machine will provide more than ample security for their needs, and it's been mentioned already that Qubes itself is great so nobody is discounting the value there. The problem is we are not talking about normal people. We are talking about highly specific, highly special people handling highly valuable work, dogged by highly powerful hostiles. The very nature of these people and their work is ridiculous, which necessitates considering ridiculous threat models and implementing ridiculous security measures to guard against them. Where someone needs an air gap, replacing that with Qubes is mind bogglingly stupid because to quote karma_pharmer who put it very poignantly[1]: That is not an air gap. [1]: https://news.ycombinator.com/item?id=39951031 https://news.ycombinator.com/item?id=39951031
- ycombinatrix 3y ago
  Did you even read the comment you're replying to? >If your threat model can be satisfactorily defended using virtual machines, you never needed air gapping in the first place.
  - amluto 3y ago
    I did. There’s a very reasonable threat model in which KVM or Hyper-V or bhyve or Xen is inadequate and an air gap provides stronger protection. But that’s not my point at all. Many uses of computers need to interact with potentially untrustworthy data, and make uses need to interact with untrustworthy transports that carry trusted data. An air gap is of little value if nothing can cross it. (Yes, some sets of threat models and design criteria allow data diodes.) If I had a nation-state budget and wanted to get data across a gap, I would look toward a deterministic, formally verified VM. This is quite practical — a very simple, small VM can run an emulator that can emulate x86 or ARM. And I would also consider an air gap. But keep in mind that an air gap does not protect against persistent compromise of the thing on one side, whereas a formally verified VM does.
deleted 3y ago
[deleted]
greggsy 3y ago
I know exactly what it is, and you should read my comment.
- Dalewyn 3y ago
  If you are seriously suggesting a virtual machine is the same thing as an air gap, then no: You do not know what air gapping is. Not the least because there is literally no god damn gap with a virtual machine on a host computer. There is no way to guarantee there will be no unauthorized access or movement of data without a hard, physical gap requiring manual, scrutinized traversal. No amount of software or hardware mitigations can suffice. If Qubes is satisfactory for The Guardian, then they never needed air gapping in the first place. I find that hard to believe given what their job description is, but that is ultimately none of my business (though I won't give them any sensitive information, for the safety of both myself and others). Meanwhile, if you need air gapping then Qubes by itself absolutely cannot satisfy your security needs. Because a virtual machine is not an air gap.
  - jmprspret 3y ago
    > If you are seriously suggesting a virtual machine is the same thing as an air gap You absolutely still have not read their comment.
  - greggsy 3y ago
    I’m not suggesting it’s the same as an air gap. I’m suggesting that the solution sufficiently meets their requirements to do away with the need for a bona fide air gap. In fact, that’s what is implied by the quoted statement in the article. You can rant on about how they should treat their data as as if they’re nuclear launch codes, but they’ve made a deliberate decision to implement a solution that is secure enough for their needs. If you still disagree, that’s fine, but the fact that you don’t understand the immense burden that a truly air gapped network would have on users and administrators speaks volumes of your own understanding of these types of systems and solutions.
    - Dalewyn 3y ago