3 ms·

Absolutely. And I completely get the fear of losing control of one's own device, but given the downvotes I've had today on this topic - an open question: What'

Absolutely. And I completely get the fear of losing control of one's own device, but given the downvotes I've had today on this topic - an open question: What's the preferred approach amongst this audience to defend against malware on their platforms?

betterunix 13y ago
"What's the preferred approach amongst this audience to defend against malware on their platforms?" Make hiding software hard, make reimaging the system easy.
- tptacek 13y ago
  And you would do that exactly how? Be as specific as you can.
  - betterunix 13y ago
    They are just design principles; I did not claim to have a well-planned design ready to go to market. Some operating systems make it harder to hide software than others; GNU/Linux makes hiding software more difficult than Windows or Mac OS X. Some computers are easier to reimage than others (e.g. special key sequences during the boot process will cause a "factory reset").
- ised 13y ago
  For the record, I've already achieved this. It is not difficult. 1. Reduce the attack surface, i.e. total LOC. My base system is super small. More complex things can be run on top of it (e.g. via chroot), but the system I boot into is only about 16MB. With some effort, it could be shrunk to about 1/4 of that size. 2. Use only open source software; and refine your methods for searching through code for suspicious things. There's no shortage of open source solutions and folks right here on HN (e.g. Russ Cox) have been kind enough to share some decent methods for efficiently searching through code. 3. Boot from read-only external media, use a memory disk for the root filesystem and use tmpfs for all writable directories/partitions. This way boot times are fast and consistent, more so than with harddisk drives. And with the rootfs in memory, you can remove the external media after booting, freeing up the USB or SD card port for other things. It's very easy to replicate (clone, image, whatever you choose to call it) this system and transfer it to more external media. It takes only a short time to compile from scratch, even on underpowered computers. There is no "software installation". You insert the media and boot. That's it. You get the same pristine system every time you boot. To anyone who injects doubt and insinuates that such an approach to evading malware as betterunix suggests is infeasible or unachievable: I'm happy to prove you wrong.
  - mwcampbell 13y ago
    This system of yours sounds very interesting. Did you strip down an existing GNU/Linux distro, or build a base system from scratch? A pointer to an ISO image and/or repo with build scripts would be great.

betterunix 13y ago

"What's the preferred approach amongst this audience to defend against malware on their platforms?" Make hiding software hard, make reimaging the system easy.

tptacek 13y ago
And you would do that exactly how? Be as specific as you can.
- betterunix 13y ago
  They are just design principles; I did not claim to have a well-planned design ready to go to market. Some operating systems make it harder to hide software than others; GNU/Linux makes hiding software more difficult than Windows or Mac OS X. Some computers are easier to reimage than others (e.g. special key sequences during the boot process will cause a "factory reset").
ised 13y ago
For the record, I've already achieved this. It is not difficult. 1. Reduce the attack surface, i.e. total LOC. My base system is super small. More complex things can be run on top of it (e.g. via chroot), but the system I boot into is only about 16MB. With some effort, it could be shrunk to about 1/4 of that size. 2. Use only open source software; and refine your methods for searching through code for suspicious things. There's no shortage of open source solutions and folks right here on HN (e.g. Russ Cox) have been kind enough to share some decent methods for efficiently searching through code. 3. Boot from read-only external media, use a memory disk for the root filesystem and use tmpfs for all writable directories/partitions. This way boot times are fast and consistent, more so than with harddisk drives. And with the rootfs in memory, you can remove the external media after booting, freeing up the USB or SD card port for other things. It's very easy to replicate (clone, image, whatever you choose to call it) this system and transfer it to more external media. It takes only a short time to compile from scratch, even on underpowered computers. There is no "software installation". You insert the media and boot. That's it. You get the same pristine system every time you boot. To anyone who injects doubt and insinuates that such an approach to evading malware as betterunix suggests is infeasible or unachievable: I'm happy to prove you wrong.
- mwcampbell 13y ago
  This system of yours sounds very interesting. Did you strip down an existing GNU/Linux distro, or build a base system from scratch? A pointer to an ISO image and/or repo with build scripts would be great.