5 ms·
1) Their idealized attacker "can observe every packet of all communications at any hop in any network path between an initiator and a recipient" 2) Therefore:
by m3047 2y ago
1) Their idealized attacker "can observe every packet of all communications at any hop in any network path between an initiator and a recipient"
2) Therefore: "Protocols that do not encrypt their payload make the entire content of the communication available to the idealized attacker along their path."
3) Furthermore: "When store-and-forward protocols are used, intermediaries leave this data subject to observation by an attacker that has compromised these intermediaries..."
I will now prove a negative: If the idealized attacker has 1 then they've already achieved 3. Therefore this is a bullshit line of argument.
What next? Read your eyeballs with your web cam? Do I need to encrypt traffic on loopback? Where is "reasonable" here? There is no such thing as absolute zero trust or absolute air gap. Is the "idealized defender" an idiot who thinks that encrypting loopback mitigates pwnage at the os or hardware level? What role does deception, salting, misdirection play in a healthy security posture?
This should be interpreted as a followon to RFC 7258 (cited in the Introduction): "While PM is an attack, other forms of monitoring that might fit the definition of PM can be beneficial and not part of any attack, e.g., network management functions monitor packets or flows..."
I am reminded of this from RFC 1034: "Clients of the domain system should be able to identify trusted name servers they prefer to use before accepting referrals to name servers outside of this 'trusted' set." and rhetorically now I ask how has that worked out?
Not discounting that the technical issues and scenarios are valid, but to point out the blatantly political nature of this rhetoric.
What this gets us at the level of technical implementation is e.g. qname minimization, which in turn begets moaning about lame delegations (I don't deny they are a problem) and the horrible horrible excess traffic they cause... entirely omitting the fact that qname minimization can double the number of unprimed queries required to resolve a name. Just one example.
- Aerbil313 2y agoIs it possible to create totally network-safe (unexploitable from the network interface) computers should you start from scratch and write a new OS today? Maybe formally verified network interfaces and capability inheritance based process execution, with granular capabilities protected with a memory safe language? I'm thinking Theseus OS, with formal verification of anything that is on the network boundary.
- m3047 2y ago> should you start from scratch Not in somebody else's cloud. :-p But ok. So there is the issue of compilers carrying binary-only payloads, which are only passed on when compiling the compiler. Really paranoid people worry about this, so it fits in the set of theoretical and demonstrated issues. But I don't have references for you off the top of my head; it's been acknowledged for a very long time. I'm ok with heterogenenaety and calling it good enough.
- Aerbil313 2y agoSure, be ok with the status quo, you do you. But there will emerge young people who'll see the absolutely immense yet utterly overlooked advantages of a computing stack written from scratch, and they'll take on the enormous burden. Watch out, it's about time the world stop running on a kernel written in 1991. Software does age with real world time, and it shall die a natural death if it is to not to be kept in life support at ever increasing expense. Open source could write 5 fully functional and modern Software Development, Distribution and Running Infrastructures (currently known as an OS) per day if all the effort didn't went into the hospitalization of the current ones and the ecosystems surrounding them.
- m3047 2y ago> it's about time the world stop running on a kernel written in 1991 In the spirit of debate only, I observe that the Theseus legend concerns the farmer's axe: replaced the handle three times and the head twice, still a damned good axe. Thus marches whatever software you cite: the legionnaires may die and be replaced but the legion marches on. A lot of the burgeoning cost concerns camp followers rather than the legion itself. You seem to get that in your reference to ecosystems. Having trouble getting water in camp? If your pack animals are dying it's a different concern than your follower's. I mean, whose animals are you going to eat first? I would like nothing better than to be running on a kernel written in 1584. (Arbitrarily chosen year, seriously.)
- Aerbil313 2y ago