7 ms·

Nice work. I wonder whether we are on the right track with such architectures though. It seems with every security framework envisioned to combat some set of at

Nice work. I wonder whether we are on the right track with such architectures though. It seems with every security framework envisioned to combat some set of attacks, a whole new class of issues pop up. And I don't _feel_ like things are more secure in the end. A bit like dutch tax law, it is just a stack of patches to fix exploits and it might have achieved consciousness already! ;)

pjmlp 2y ago
Because many of these systems aren't designed end to end to be properly secure. The right way to do it usually fails the market due to backwards compatibility or developer pushback to adopt such features (see WinRT sandbox). Mobile phones security has it easier, because there wasn't backwards compatibility to care about, and so far the stores gatekeeping means that developers that want to play there have to oblige anyway.
- freedomben 2y ago
  > developers that want to play there That pun was superb btw
- jarjoura 2y ago
  That's not fair. The sandbox was not the reason for WinRT/UWP's failure in the market. It was the mostly unfinished tablet UI that they half ported from their phone and told developers that was the future. They even copied Apple and threw in some half-baked store with it. There was no way Microsoft was going to become successful at it, especially when Apple couldn't even get developers excited about their own implementation. Most desktop software needs to provide value for customers, or they would just build the web version of it. Being "native" isn't enough. So, if you want to require that us developers run our stuff inside of sandboxes, that's fine. Just make sure the sandbox doesn't prevent our software from getting access to the same important desktop surfaces.
  - SSLy 2y ago
    windows had an app store back in vista days.
Y_Y 2y ago
Funny that you should mention Dutch tax law. I don't think it's controversial to say that some of those "exploits" were deliberately inserted. One may speculate that there are also some powerful forces pushing for more vulnerabilities in consumer computing. Here are high-profile examples of each: https://en.wikipedia.org/wiki/Dutch_Sandwich https://en.wikipedia.org/wiki/Dutch_Sandwich https://en.wikipedia.org/wiki/Intel_Management_Engine#Assertions_that_ME_is_a_backdoor https://en.wikipedia.org/wiki/Intel_Management_Engine#Assert...
- rustcleaner 2y ago
  Barium-class downboats appear to be sinking your battleship! :^O
- result2vino 2y ago
  [dead]
- saagarjha 2y ago
  Think again.
  - Y_Y 2y ago
    I'd be happy to, world you like to offer a suggestion?
    - saagarjha 2y ago
      As long as I don't see you joining the usual "duh this is a government backdoor" crowd next time any bug comes up, sure. This blog post describes a class of vulnerabilities. That's why there are ten of them. A well-resourced adversary with the capability to influence software development would want their backdoor to be small and difficult to discover. In many cases they would like guarantees that they are the only entity to be able to abuse such a vulnerability. While one can argue that these bugs were difficult to find–they were only fixed now–they really aren't very good backdoor bugs. Why leave dozens of holes all over the place when you only need a few? It's much more likely that this is just a failure case that someone failed to consider.
gxt 2y ago
Ultimately security is incompatible with backwards compatibility. All OSes in prod today need to be rebuilt from the ground up to be secure for the next century. That means throwing out a lot of code too. It's the cost to pay.
- fsflover 2y ago
  > All OSes in prod today need to be rebuilt from the ground up to be secure for the next century Qubes OS solves this with hardware virtualization, which is really fast and secure.
  - PhilipRoman 2y ago
    Compartmentalization is only a part of the solution. Once you have that finished, you still need to deal with the actual vulnerabilities in guests, which will contain your secrets and be exposed to the internet, one way or another.
    - fsflover 2y ago
      Guests don't have to be exposed to the Internet [0] or even run full OSes [1]. [0] https://www.qubes-os.org/doc/how-to-organize-your-qubes/ https://www.qubes-os.org/doc/how-to-organize-your-qubes/ [1] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
      - ylk 2y ago
        In what way are [1] not “full OSes”? They’re minimal templates, but afaik they still run systemd, the kernel, etc. needed to boot the standard Linux systems they are. When I clicked the link I was expecting something like a unikernel, eg https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewa...
        fsflover 2y ago

pjmlp 2y ago

Because many of these systems aren't designed end to end to be properly secure. The right way to do it usually fails the market due to backwards compatibility or developer pushback to adopt such features (see WinRT sandbox). Mobile phones security has it easier, because there wasn't backwards compatibility to care about, and so far the stores gatekeeping means that developers that want to play there have to oblige anyway.

freedomben 2y ago
> developers that want to play there That pun was superb btw
jarjoura 2y ago
That's not fair. The sandbox was not the reason for WinRT/UWP's failure in the market. It was the mostly unfinished tablet UI that they half ported from their phone and told developers that was the future. They even copied Apple and threw in some half-baked store with it. There was no way Microsoft was going to become successful at it, especially when Apple couldn't even get developers excited about their own implementation. Most desktop software needs to provide value for customers, or they would just build the web version of it. Being "native" isn't enough. So, if you want to require that us developers run our stuff inside of sandboxes, that's fine. Just make sure the sandbox doesn't prevent our software from getting access to the same important desktop surfaces.
- SSLy 2y ago
  windows had an app store back in vista days.

Y_Y 2y ago

Funny that you should mention Dutch tax law. I don't think it's controversial to say that some of those "exploits" were deliberately inserted. One may speculate that there are also some powerful forces pushing for more vulnerabilities in consumer computing. Here are high-profile examples of each: https://en.wikipedia.org/wiki/Dutch_Sandwich https://en.wikipedia.org/wiki/Dutch_Sandwich https://en.wikipedia.org/wiki/Intel_Management_Engine#Assertions_that_ME_is_a_backdoor https://en.wikipedia.org/wiki/Intel_Management_Engine#Assert...

rustcleaner 2y ago
Barium-class downboats appear to be sinking your battleship! :^O
result2vino 2y ago
[dead]
saagarjha 2y ago
Think again.
- Y_Y 2y ago
  I'd be happy to, world you like to offer a suggestion?
  - saagarjha 2y ago
    As long as I don't see you joining the usual "duh this is a government backdoor" crowd next time any bug comes up, sure. This blog post describes a class of vulnerabilities. That's why there are ten of them. A well-resourced adversary with the capability to influence software development would want their backdoor to be small and difficult to discover. In many cases they would like guarantees that they are the only entity to be able to abuse such a vulnerability. While one can argue that these bugs were difficult to find–they were only fixed now–they really aren't very good backdoor bugs. Why leave dozens of holes all over the place when you only need a few? It's much more likely that this is just a failure case that someone failed to consider.

gxt 2y ago

Ultimately security is incompatible with backwards compatibility. All OSes in prod today need to be rebuilt from the ground up to be secure for the next century. That means throwing out a lot of code too. It's the cost to pay.

fsflover 2y ago
> All OSes in prod today need to be rebuilt from the ground up to be secure for the next century Qubes OS solves this with hardware virtualization, which is really fast and secure.
- PhilipRoman 2y ago
  Compartmentalization is only a part of the solution. Once you have that finished, you still need to deal with the actual vulnerabilities in guests, which will contain your secrets and be exposed to the internet, one way or another.
  - fsflover 2y ago
    Guests don't have to be exposed to the Internet [0] or even run full OSes [1]. [0] https://www.qubes-os.org/doc/how-to-organize-your-qubes/ https://www.qubes-os.org/doc/how-to-organize-your-qubes/ [1] https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/
    - ylk 2y ago
      In what way are [1] not “full OSes”? They’re minimal templates, but afaik they still run systemd, the kernel, etc. needed to boot the standard Linux systems they are. When I clicked the link I was expecting something like a unikernel, eg https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ https://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewa...
      - fsflover 2y ago