3 ms·

VT-x. You should get the name of the technology right before defending it. VT-d is the I/O virtualization technology. When did it become customary to defend pe

by Veserv 2y ago

VT-x. You should get the name of the technology right before defending it. VT-d is the I/O virtualization technology. When did it become customary to defend people making claims of security instead of laughing in their face even though history shows them such claims to be a endless clown parade? How about you present the extraordinary evidence needed to support the extraordinary claim that there are no vulnerabilities? I will accept simple forms of proof such as a formal proof of correctness or a unclaimed 10 M$ bug bounty that has never been claimed.

tptacek 2y ago
Not an especially impressive flex, but I'm not above trying to dunk on people for misspelling things either, so I'm not going to high-horse you about it (obviously i am). The history of KVM and hardware virtualization is not an endless clown parade. Find a vulnerability researcher to talk to about OpenBSD sometime, though. https://isopenbsdsecu.re/ https://isopenbsdsecu.re/
- Veserv 2y ago
  OpenBSD is not secure by any measure. That Theo happens to be right about the endless clown parade is independent of his ability to develop a secure operating system. I mean, jeez, even Joanna Rutkowska acknowledges the foundations are iffy enough to only justify claiming “reasonably secure” for Qubes OS. You are making a extraordinary claim of security which stands diametrically opposed to the consensus that things are easily hacked. You need to present extraordinary evidence to support such a claim. You can see my other reply for what I would consider minimal criteria for evidence.
  - tptacek 2y ago
    So far all I'm seeing here are appeals to the names of people who I don't believe agree with your take. You're going to need to actually defend the argument you made.
    - Veserv 2y ago
      You mean your argument that it is hard to find a vulnerability, despite the fact that commercial systems in Unix kernel lineage have historically been easy to hack and have never once demonstrated high robustness? You have not even established what level of security you are arguing has been achieved. This is not even moving the goalposts, this is Calvinball. I contend that a major cloud service, that runs trillions of dollars of commerce is at least as important as a fighter jet. The F-35 demanded a operating system certified according to the SKPP which follows in the heels of the Orange Book Level A1. That demanded a formal specification, formal proofs, and a failed penetration test by the NSA. Do you contend that KVM has reached such a standard? Or do you argue that such a standard is too high? What standard should be expected? How do you verify such a standard has been achieved? How does that trace to operational security goals? The operational security goal commerce needs is for the expected value of an attack to be unprofitable. How are you verifying your axiomatic arguments are moving that needle? Thinking that everything is insecure and all that matters is “better” is not even binary thinking, it is unary thinking. There is no meaningful discussion to be had until you: 1. Establish a measure and level of security that matches operational goals. 2. Demonstrate proposed mechanisms empirically achieve such goals or have a track record of achieving the desired level of quality such that the reputation may provide some coarse substitute for evidence. Until that point it is: “Dude, trust me. I have been wrong every time before, but I totally got it this time.”
      - tptacek 2y ago
        Do you feel like this is going well for you?
        Veserv 2y ago
        Yes. You have been unable to provide any objective or quantitative means of evaluating security and reject any attempt to do so. You even reject attempts to characterize what would constitute an objective minimum bar for adequacy. "I can not evaluate my work, I demand you do not evaluate my work, and I do not even know what my goal is, but I can tell you hot or cold." What you have there is not engineering, it is art and is why commercial IT software security is a joke.
- yjftsjthsd-h 2y ago
  > Find a vulnerability researcher to talk to about OpenBSD sometime, though. > https://isopenbsdsecu.re/ https://isopenbsdsecu.re/ Notice that at no point does anyone actually show up with a working exploit.
- fsflover 2y ago
  I did mean VT-d, not VT-x. This is what Qubes OS uses for virtualization; my daily driver. Last escape was in 2006 by the Qubes founder.

by Veserv 2y ago

tptacek 2y ago

Not an especially impressive flex, but I'm not above trying to dunk on people for misspelling things either, so I'm not going to high-horse you about it (obviously i am). The history of KVM and hardware virtualization is not an endless clown parade. Find a vulnerability researcher to talk to about OpenBSD sometime, though. https://isopenbsdsecu.re/ https://isopenbsdsecu.re/

Veserv 2y ago
OpenBSD is not secure by any measure. That Theo happens to be right about the endless clown parade is independent of his ability to develop a secure operating system. I mean, jeez, even Joanna Rutkowska acknowledges the foundations are iffy enough to only justify claiming “reasonably secure” for Qubes OS. You are making a extraordinary claim of security which stands diametrically opposed to the consensus that things are easily hacked. You need to present extraordinary evidence to support such a claim. You can see my other reply for what I would consider minimal criteria for evidence.
- tptacek 2y ago
  So far all I'm seeing here are appeals to the names of people who I don't believe agree with your take. You're going to need to actually defend the argument you made.
  - Veserv 2y ago
    You mean your argument that it is hard to find a vulnerability, despite the fact that commercial systems in Unix kernel lineage have historically been easy to hack and have never once demonstrated high robustness? You have not even established what level of security you are arguing has been achieved. This is not even moving the goalposts, this is Calvinball. I contend that a major cloud service, that runs trillions of dollars of commerce is at least as important as a fighter jet. The F-35 demanded a operating system certified according to the SKPP which follows in the heels of the Orange Book Level A1. That demanded a formal specification, formal proofs, and a failed penetration test by the NSA. Do you contend that KVM has reached such a standard? Or do you argue that such a standard is too high? What standard should be expected? How do you verify such a standard has been achieved? How does that trace to operational security goals? The operational security goal commerce needs is for the expected value of an attack to be unprofitable. How are you verifying your axiomatic arguments are moving that needle? Thinking that everything is insecure and all that matters is “better” is not even binary thinking, it is unary thinking. There is no meaningful discussion to be had until you: 1. Establish a measure and level of security that matches operational goals. 2. Demonstrate proposed mechanisms empirically achieve such goals or have a track record of achieving the desired level of quality such that the reputation may provide some coarse substitute for evidence. Until that point it is: “Dude, trust me. I have been wrong every time before, but I totally got it this time.”
    - tptacek 2y ago
      Do you feel like this is going well for you?
      - Veserv 2y ago
        Yes. You have been unable to provide any objective or quantitative means of evaluating security and reject any attempt to do so. You even reject attempts to characterize what would constitute an objective minimum bar for adequacy. "I can not evaluate my work, I demand you do not evaluate my work, and I do not even know what my goal is, but I can tell you hot or cold." What you have there is not engineering, it is art and is why commercial IT software security is a joke.
yjftsjthsd-h 2y ago
> Find a vulnerability researcher to talk to about OpenBSD sometime, though. > https://isopenbsdsecu.re/ https://isopenbsdsecu.re/ Notice that at no point does anyone actually show up with a working exploit.
fsflover 2y ago
I did mean VT-d, not VT-x. This is what Qubes OS uses for virtualization; my daily driver. Last escape was in 2006 by the Qubes founder.