3 ms·

At least when you are building key infrastructure for the government, directly or indirectly through third parties. I don’t think it’s unreasonable. And it is

At least when you are building key infrastructure for the government, directly or indirectly through third parties. I don’t think it’s unreasonable. And it is not as absolute as you make it sound. Only dependencies for specific critical functions may be regulated. And they don’t have to literally force a whitelist of dependencies on you, just whichever has been certified as appropriate for that purpose.

svieira 2y ago
This is how you get FIPS 140 [1], which for those not in the know is a US Federal standard that mandates encryption which is _less_ secure the the current state of the art and has been for decades. (Yes, there's a new version which was approved 5 years ago and which is still rolling out [2]). [1]: https://en.wikipedia.org/wiki/FIPS_140 https://en.wikipedia.org/wiki/FIPS_140 [2]: https://csrc.nist.gov/Projects/fips-140-3-transition-effort https://csrc.nist.gov/Projects/fips-140-3-transition-effort
- gizmo686 2y ago
  At the same time, turning on FIPs mode is the way we discover that some of our modules were using MD5 in security critical places. Because the government actually enforces FIPS, people (primarily Red Hat I think), now actually put in the bare minimum of engineering effort so that when you set fips=1, the system will actually enforce the policy (unless you go out of your way to override it, or use a non distribution provided crypto stack). Sure, now that the infrastructure for this has been built, it can be configured to require stronger crypto then FIPS does, but that infrastructure would never have been built without the likes of FIPS, and the government mandating it's use. And I know this because even with all of the hard engineering work done of building that infrastructure, there are no commonly used stronger policies; because the only people who actually care are the ones forced to care by the likes of FIPS. Our electrical standards might not the safest way of wiring buildings, and not what we would come up with if we wrote the standards today. But they are orders of magnitude safer then what electricians would be doing without the standards.
maxwell 2y ago
Who maintains the mandated dependencies? Who performs certification? What prevents regulatory capture?
- exe34 2y ago
  how does it work for aircrafts? how does it work for anti-money laundering policies?
  - lucianbr 2y ago
    The way it works for aircraft is that now it's getting prohibitively expensive to design new planes. But new planes are still needed, so Boeing found a solution, and made the 737-MAX which is in theory an upgrade that does not require re-certification, but is in fact different enough that the differences lead to hundreds of deaths. Perhaps without the certifications lots more people would have died. I'm just an armchair analyst. Just food for thought.
    - gorft 2y ago
      Uh, the MAX was a disaster because Boeing is run by MBAs instead of engineers. Regulation is why air travel is remarkably safe. Those rules are written in blood, something everyone here conveniently seems to forget.
      - lucianbr 2y ago
        So you write regulations for software development, but software companies run by MBAs instead of engineers can still cause disasters. I guess as long as disasters are rare, it's a win. Is Fujitsu run by engineers?
    - exe34 2y ago
      lots of people did die without the regulations!
- gorft 2y ago
  Famously, civil engineering has never solved this problem, either, leading to the sad state of affairs in which we find ourselves today, wherein no bridges have been built anywhere.

svieira 2y ago

This is how you get FIPS 140 [1], which for those not in the know is a US Federal standard that mandates encryption which is _less_ secure the the current state of the art and has been for decades. (Yes, there's a new version which was approved 5 years ago and which is still rolling out [2]). [1]: https://en.wikipedia.org/wiki/FIPS_140 https://en.wikipedia.org/wiki/FIPS_140 [2]: https://csrc.nist.gov/Projects/fips-140-3-transition-effort https://csrc.nist.gov/Projects/fips-140-3-transition-effort

gizmo686 2y ago
At the same time, turning on FIPs mode is the way we discover that some of our modules were using MD5 in security critical places. Because the government actually enforces FIPS, people (primarily Red Hat I think), now actually put in the bare minimum of engineering effort so that when you set fips=1, the system will actually enforce the policy (unless you go out of your way to override it, or use a non distribution provided crypto stack). Sure, now that the infrastructure for this has been built, it can be configured to require stronger crypto then FIPS does, but that infrastructure would never have been built without the likes of FIPS, and the government mandating it's use. And I know this because even with all of the hard engineering work done of building that infrastructure, there are no commonly used stronger policies; because the only people who actually care are the ones forced to care by the likes of FIPS. Our electrical standards might not the safest way of wiring buildings, and not what we would come up with if we wrote the standards today. But they are orders of magnitude safer then what electricians would be doing without the standards.

maxwell 2y ago

Who maintains the mandated dependencies? Who performs certification? What prevents regulatory capture?

exe34 2y ago
how does it work for aircrafts? how does it work for anti-money laundering policies?
- lucianbr 2y ago
  The way it works for aircraft is that now it's getting prohibitively expensive to design new planes. But new planes are still needed, so Boeing found a solution, and made the 737-MAX which is in theory an upgrade that does not require re-certification, but is in fact different enough that the differences lead to hundreds of deaths. Perhaps without the certifications lots more people would have died. I'm just an armchair analyst. Just food for thought.
  - gorft 2y ago
    Uh, the MAX was a disaster because Boeing is run by MBAs instead of engineers. Regulation is why air travel is remarkably safe. Those rules are written in blood, something everyone here conveniently seems to forget.
    - lucianbr 2y ago
      So you write regulations for software development, but software companies run by MBAs instead of engineers can still cause disasters. I guess as long as disasters are rare, it's a win. Is Fujitsu run by engineers?
  - exe34 2y ago
    lots of people did die without the regulations!
gorft 2y ago
Famously, civil engineering has never solved this problem, either, leading to the sad state of affairs in which we find ourselves today, wherein no bridges have been built anywhere.