3 ms·

"process isolation is the bedrock of all other security guarantees" means process isolation is a necessary (in practice) condition, not a sufficient condition.

by Veserv 2y ago

"process isolation is the bedrock of all other security guarantees" means process isolation is a necessary (in practice) condition, not a sufficient condition. "Tell me how process isolation prevents SQL injection." is a non-sequitur because that is only coherent if they claimed process isolation is a sufficient condition. To disagree with their position, you need to demonstrate a system where there is no process isolation and where maliciously crafted inputs intended to cause SQL injection can not result in undesired database access. So, one process gets to arbitrarily modify the contents of the SQL server process including changing the code and you need to prevent it from wrecking your database.

ryao 2y ago
"process isolation is the bedrock of all other security guarantees" means process isolation is a necessary (in practice) condition, not a sufficient condition The attack surface of networked machines is unaffected by process isolation. It is only when you are already inside does process isolation have any use. Thus the idea that it is the bedrock is wrong. "Tell me how process isolation prevents SQL injection." is a non-sequitur because that is only coherent if they claimed process isolation is a sufficient condition. It is a counter example that shows that process isolation is not the bedrock that it was claimed to be. Id sequitur. To disagree with their position, you need to demonstrate a system where there is no process isolation and where maliciously crafted inputs intended to cause SQL injection can not result in undesired database access. So, one process gets to arbitrarily modify the contents of the SQL server process including changing the code and you need to prevent it from wrecking your database. Non sequitur applies here. The protection against SQL injection and process isolation have no link whatsoever. The fact that there is no link was my entire point. The example did not need to be SQL injection either. Telling me that I need to prove a link that is the opposite of what I was saying does not follow at all. As I previously said, I could have cited just about any common vulnerability and process isolation would have done nothing about it. For example: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ I only cited SQL injection because I could not think of any claim more absurd than the claim that process isolation is bedrock of guarantees against SQL injection, but if process isolation were the bedrock of all other security guarantees, then it would some relationship to protection against sql injection.
- Veserv 2y ago
  You do not appear to understand the difference between "necessary" and "sufficient". Process isolation is not sufficient (i.e. adequate on its own) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because it does not sprinkle magical security pixie dust on it. Process isolation is necessary (in practice) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because otherwise a attacker can just modify the code of the SQL server to directly do the undesired database accesses. Without process isolation your SQL server security/design can be bypassed. The amazing thick walls of your castle do not matter if you built it on sand. The amazing solid bedrock is not sufficient to claim your castle is defensible if your castle is a wooden shack, but it is necessary for building a defensible castle.
  - ryao 2y ago
    A lack of process isolation does not allow your SQL server security to be bypassed when the adversary is not on the machine in the first place. The adversary would usually fill out a field on a form, which is where SQL injection attacks usually occur: https://xkcd.com/327/ https://xkcd.com/327/ OSv for example does not have process isolation, yet applications on it are not considered insecure.
mmooss 2y ago
I read "bedrock" as 'necessary to all other security'. But arguing about word choice isn't useful; the question is what indolering actually meant.

by Veserv 2y ago

ryao 2y ago

"process isolation is the bedrock of all other security guarantees" means process isolation is a necessary (in practice) condition, not a sufficient condition The attack surface of networked machines is unaffected by process isolation. It is only when you are already inside does process isolation have any use. Thus the idea that it is the bedrock is wrong. "Tell me how process isolation prevents SQL injection." is a non-sequitur because that is only coherent if they claimed process isolation is a sufficient condition. It is a counter example that shows that process isolation is not the bedrock that it was claimed to be. Id sequitur. To disagree with their position, you need to demonstrate a system where there is no process isolation and where maliciously crafted inputs intended to cause SQL injection can not result in undesired database access. So, one process gets to arbitrarily modify the contents of the SQL server process including changing the code and you need to prevent it from wrecking your database. Non sequitur applies here. The protection against SQL injection and process isolation have no link whatsoever. The fact that there is no link was my entire point. The example did not need to be SQL injection either. Telling me that I need to prove a link that is the opposite of what I was saying does not follow at all. As I previously said, I could have cited just about any common vulnerability and process isolation would have done nothing about it. For example: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ I only cited SQL injection because I could not think of any claim more absurd than the claim that process isolation is bedrock of guarantees against SQL injection, but if process isolation were the bedrock of all other security guarantees, then it would some relationship to protection against sql injection.

Veserv 2y ago
You do not appear to understand the difference between "necessary" and "sufficient". Process isolation is not sufficient (i.e. adequate on its own) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because it does not sprinkle magical security pixie dust on it. Process isolation is necessary (in practice) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because otherwise a attacker can just modify the code of the SQL server to directly do the undesired database accesses. Without process isolation your SQL server security/design can be bypassed. The amazing thick walls of your castle do not matter if you built it on sand. The amazing solid bedrock is not sufficient to claim your castle is defensible if your castle is a wooden shack, but it is necessary for building a defensible castle.
- ryao 2y ago
  A lack of process isolation does not allow your SQL server security to be bypassed when the adversary is not on the machine in the first place. The adversary would usually fill out a field on a form, which is where SQL injection attacks usually occur: https://xkcd.com/327/ https://xkcd.com/327/ OSv for example does not have process isolation, yet applications on it are not considered insecure.

mmooss 2y ago

I read "bedrock" as 'necessary to all other security'. But arguing about word choice isn't useful; the question is what indolering actually meant.