3 ms·

I call bullshit. Someone, somewhere long ago deep inside of the bowels of the NSA decided to deprioritize actual security, and the use of the capability securi

I call bullshit. Someone, somewhere long ago deep inside of the bowels of the NSA decided to deprioritize actual security, and the use of the capability security model. They knowingly did this, because actually secure computing (which they already had at the time[1,2,3]) represented a threat to the NSA, or so they thought at the time. The trade-offs seemed acceptable, because there were systemic approaches at the time that could keep things secure via other means, such as air-gapping, TEMPEST screening, etc. Much like the consumer decision on the other side of that secrecy barrier, when it was decided the MULTICS was too complex, and you really didn't need all of that complexity (to allow mutli-level security), the easing of hardware requirements, and systems design time all seemed worth it. Here we are 50 years later, and both decisions have proven to be disastrous. We've swiss-cheesed our infrastructure in a manner that can only be hinted at metaphorically. The closest analogies I know are: Imagine the power grid and modern society, with absolutely zero circuit breakers or fuses. Imagine running an economy without being able to divide wealth into uniform small amounts, dollars, cents, etc. In both cases, everything becomes all or nothing. This is what we have with computers, all or nothing. You have to trust software you run, or you simply can't run it. It's the same with the "License Agreement", nobody actually reads them, and nobody tries to enforce them, yet there they are. It's possible to have secure computing, we had it in the 1980s, but we didn't realize it. It was crude, but effective, because we had systems with no persistent internal storage, and we could write protect the storage we had. Thus it was possible to manage data, and the side effects allowed, in a simple, powerful way by simply not putting data at risk, making copies, and using those instead. Until we reverse the bad decisions of the 1970s, we're going to keep up the deranged behavior, blaming everything and everyone, and ignoring the one way out of this. You shouldn't ever have to trust a program you execute to behave in the manner you expect. Your computer should enforce the limits you expect, and the program should have zero ways around those limits. [1] https://csrc.nist.rip/publications/history/ande72.pdf https://csrc.nist.rip/publications/history/ande72.pdf [2] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security [3] https://web.archive.org/web/20120919111301/http://www.albany.edu/acc/courses/ia/classics/belllapadula1.pdf https://web.archive.org/web/20120919111301/http://www.albany...

Veserv 3y ago
Your assessment of the current state of affairs is spot on. However, there are a few additions. A. It is not metaphorically swiss-cheesed, the swiss-cheese model [1] of software security is officially endorsed. Just stack enough trash and maybe it will be okay is now accepted policy. B. It was not driven by the NSA. It was actually driven by commercial software vendors like Microsoft and Cisco who could not meet minimum security standards, so demanded the standards be lowered to allow them to make sales. Any time the NSA gets the drivers seat in setting government security procurement standards they almost always push for actual security since the NSA is the government; they are protecting themselves. It is reasonable to distrust them for commercial and external systems, but you can trust their standards for their own and government systems are not meaningfully compromised. [1] https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
mike_hearn 3y ago
You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. Capabilities aren't magic. UNIX has had many forms of capability for a long time, NeXT/macOS/iOS uses them extensively as well, and there are still vulnerabilities regardless. Also, capabilities are irrelevant to the types of hack being discussed on this thread where the vectors are forgotten admin accounts, non-patched software, etc.
- mikewarot 3y ago
  Capabilities are magic, if you don't have them. People confuse permission flags, such as those found in smartphones, etc.. or locking down permissions a-prior as in app-armor, with capabilities. The ability, at run time, to pick a file, and give only that file, folder, or set of resources to a piece of software is essential to secure computing. As far as I know, NeXT/macOS/iOS et all don't have that ability.
  - mike_hearn 3y ago
    Try this experiment: 1. Write a macOS app that has a button which uses the file open window to load a document. 2. Enable the app sandbox by adding the relevant entitlement. 3. Prove to yourself it works by adding some code that directly fopen()s a file in your home directory and watching it fail. 4. Open that file by clicking the button and selecting it in the open dialog. Observe that you can now read it. Or just go read Apple's documentation that explains their capabilities architecture in detail. Look for docs on sandbox extensions and Mach ports.

Veserv 3y ago

Your assessment of the current state of affairs is spot on. However, there are a few additions. A. It is not metaphorically swiss-cheesed, the swiss-cheese model [1] of software security is officially endorsed. Just stack enough trash and maybe it will be okay is now accepted policy. B. It was not driven by the NSA. It was actually driven by commercial software vendors like Microsoft and Cisco who could not meet minimum security standards, so demanded the standards be lowered to allow them to make sales. Any time the NSA gets the drivers seat in setting government security procurement standards they almost always push for actual security since the NSA is the government; they are protecting themselves. It is reasonable to distrust them for commercial and external systems, but you can trust their standards for their own and government systems are not meaningfully compromised. [1] https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model

mike_hearn 3y ago

You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. Capabilities aren't magic. UNIX has had many forms of capability for a long time, NeXT/macOS/iOS uses them extensively as well, and there are still vulnerabilities regardless. Also, capabilities are irrelevant to the types of hack being discussed on this thread where the vectors are forgotten admin accounts, non-patched software, etc.

mikewarot 3y ago
Capabilities are magic, if you don't have them. People confuse permission flags, such as those found in smartphones, etc.. or locking down permissions a-prior as in app-armor, with capabilities. The ability, at run time, to pick a file, and give only that file, folder, or set of resources to a piece of software is essential to secure computing. As far as I know, NeXT/macOS/iOS et all don't have that ability.
- mike_hearn 3y ago
  Try this experiment: 1. Write a macOS app that has a button which uses the file open window to load a document. 2. Enable the app sandbox by adding the relevant entitlement. 3. Prove to yourself it works by adding some code that directly fopen()s a file in your home directory and watching it fail. 4. Open that file by clicking the button and selecting it in the open dialog. Observe that you can now read it. Or just go read Apple's documentation that explains their capabilities architecture in detail. Look for docs on sandbox extensions and Mach ports.