3 ms·

Surely we can't guarantee a really trustable system, in the end even Linux or Gcc aren't really audited before use. BUT still having open design, FLOSS code pub

by kkfx 2y ago

Surely we can't guarantee a really trustable system, in the end even Linux or Gcc aren't really audited before use. BUT still having open design, FLOSS code published from the first commit and developed openly allow to trust the people instead of the product. An example, some (Handala crew) observed that Vidisco (an Israeli company) produce the vast majority of airports and ports security scanners, and they are proprietary devices running closed source software, so potentially they have some code to allow not seeing things the Mossad marks as "not to be seen" with some kind of "tagging" or even remote commands. Could their customers trust Vidisco or John Smith llc doesn't matter? If their design it's open and their code developed FLOSS openly in the wild maybe. We can't be sure the code we see from it's start is really running inside their devices, we can't audit entirely BUT it's still much better than now. Similarly in an open world innovation inevitably happen mostly in public funded academia, meaning it's perfectly possible to infiltrate but it's still the best option we have to ensure trust and interoperability, as long as we have normal interoperability the possibility to keep something really hidden is far, far less than now. Aside, obviously States must produce in house all their critical gear, at least for some "not constant" productions (like weapons) with domestic partnership with industries normally doing other things (like automotive). A corporative world is a savage, unsafe world and probably can't be stable as well.

dredmorbius 2y ago
Tamper-evidence (which itself might be served by open and auditable HW and codes) would probably be a more robust and readily tested option. I can think of how that could be applied to SW, and possibly chip designs themselves. Overall hardware kits somewhat less so. E.g., a "resistor" or "capacitor" with its own CPU and potentially some weaponised capability could probably avoid detection from such methods. Installing an entire secondary circuit board (as seems to have been the case for the AR924 pagers used on 17 September) should be more immediately detectable, though a partial tear-down would be required. As for in-house production: there's been a greatly increased reliance on "COTS" (common off-the-shelf) products in many realms, including the military: "Off-the-Shelf Solutions for the Battlefield" (2008) How are commercial off-the-shelf products helping to drive down the military's costs? Steve Polak and Brendan Jordan discover how these products are helping coalition forces in their fight for interoperability. ... Since the 1970s the steady shift towards a consumer-based society and economy has seen civilian commercial entities increasingly replace traditional military suppliers as the leading drivers in technological advance. In no industrial sector is this more apparent than in electronics, where the once dominant technological edge of military electronics of the 1960s has been replaced with the increasingly cutting-edge nature of civilian microelectronics driven by insatiable consumer demand. <https://www.army-technology.com/features/feature1918/ https://www.army-technology.com/features/feature1918/> More generally (Wikipedia): <https://en.wikipedia.org/wiki/Commercial_off-the-shelf https://en.wikipedia.org/wiki/Commercial_off-the-shelf>

by kkfx 2y ago

dredmorbius 2y ago

Tamper-evidence (which itself might be served by open and auditable HW and codes) would probably be a more robust and readily tested option. I can think of how that could be applied to SW, and possibly chip designs themselves. Overall hardware kits somewhat less so. E.g., a "resistor" or "capacitor" with its own CPU and potentially some weaponised capability could probably avoid detection from such methods. Installing an entire secondary circuit board (as seems to have been the case for the AR924 pagers used on 17 September) should be more immediately detectable, though a partial tear-down would be required. As for in-house production: there's been a greatly increased reliance on "COTS" (common off-the-shelf) products in many realms, including the military: "Off-the-Shelf Solutions for the Battlefield" (2008) How are commercial off-the-shelf products helping to drive down the military's costs? Steve Polak and Brendan Jordan discover how these products are helping coalition forces in their fight for interoperability. ... Since the 1970s the steady shift towards a consumer-based society and economy has seen civilian commercial entities increasingly replace traditional military suppliers as the leading drivers in technological advance. In no industrial sector is this more apparent than in electronics, where the once dominant technological edge of military electronics of the 1960s has been replaced with the increasingly cutting-edge nature of civilian microelectronics driven by insatiable consumer demand. <https://www.army-technology.com/features/feature1918/ https://www.army-technology.com/features/feature1918/> More generally (Wikipedia): <https://en.wikipedia.org/wiki/Commercial_off-the-shelf https://en.wikipedia.org/wiki/Commercial_off-the-shelf>