4 ms·

Yes, and?

by tachion 13y ago

Yes, and?

opendomain 13y ago
I think he is saying, that FreeBSD ships binary device drivers - how can we trust that those do not compromise the system? If FreeBSD is open source - why are not the device drivers? If we can not trust FreeBSD for these device drivers, then why should we trust their opinion on using intel for a crypto source?
matthewmacleod 13y ago
The point was obviously that it's surprising to see that they are happy to ship binary drivers (which could contain arbitrary compromises from a user's point of view) but are not willing to trust the HWRNG (to which the same caveat applies). Of course, I don't agree with this comparison; running the output of the HWRNG through Yarrow is good practice in any case.
- AnthonyMouse 13y ago
  What's the problem with the comparison? The only real advantage of the binary blob over the hardware is that you can theoretically verify what it's doing more easily. But actually doing that verification has a difficulty on the same order as reverse engineering the driver to release an open source version, so all the existence of the binary driver does is to imply that such verification hasn't occurred -- because if it had then those doing the verification would have been in a good position to release source code (or at least complete hardware documentation) for an open source driver. Binary blob software also has the distinct disadvantage that even if you were to verify it, you would have to verify each release again whenever there is an update.
  - tachion 13y ago
    In my perspective, binary drives are a matter of choice, you can use them, but you dont have to, if you dont want to, whereas the random numbers generation is used everywhere in the OS, and you cant just decide to not to use it - that's a huge difference, what makes this comparison bad.
    - AnthonyMouse 13y ago
      Can't you though? We're really talking about defaults here. If you don't want to use the hardware RNG, you can always disable it in either the BIOS or the OS. Or use hardware that doesn't have one. The trouble is for the common user who doesn't know anything about any of this and is just going to take the defaults for everything, who is exactly the sort of person who is going to take the binary driver to "just make it work" and then be exposed to any vulnerabilities it may contain. You have to make the defaults secure because they're what most people will use. It doesn't matter that you can change it if most people never do.
  - matthewmacleod 13y ago
    Sorry, I was unclear. It's an apt comparison in that sense (it's unverified). However, there's a zero-impact workaround for this (using the CSPRNG on top of the HWRNG) so it has no user impact, whereas eliminating binary blobs does.
  - pbsd 13y ago
    The comparison is ludicrous. Non-obfuscated binaries, often with debug symbols, are much easier to reverse-engineer and analyze than hardware. Additionally, you can analyze binary diffs, much like source code. You would not start from scratch at each new version. Let's also not forget how hard it is to verify source code, and how very rarely it is done.
  - nucleardog 13y ago
    You're right in an academic sense - they're completely comparable. In reality, the difference is that we can guarantee 100% of systems to work without the hardware RNG. Every binary blob we remove removes support for hardware and 'breaks' the OS for a subset of the users. No one* is going to fire up an OS and go "Hey, this OS doesn't use my hardware RNG! This OS is broken!" They will, however, fire it up and go "Hey, this OS doesn't support my network adapter! This OS is broken!" Security versus functionality. It's always a trade-off. The most secure system is the one that does nothing - everything past there is adding functionality at the expense of an increased attack surface. * To within a margin of error.
    - AnthonyMouse 13y ago
      I don't know if they're that much different. If you turn off the hardware RNG then generating random numbers becomes significantly slower. Maybe most people don't care, but I expect most people also don't care if their network card doesn't do TOE as a result of you shipping an open source driver that isn't feature complete rather than a binary blob driver that is. The flaw in your argument is the assumption that the drawback of using a software RNG instead of a hardware RNG is inherently less than the drawback of using an open source driver instead of a proprietary binary blob driver. There may exist specific circumstances where this actually the case (as is obvious if there is no open source driver whatsoever), but that isn't the immutable state of the world. If you take this kind of security to be a Serious Issue then it demands for engineering effort (or community pressure) to be directed toward the goal of having published source code for all hardware drivers. One of the ways you can do that is by refusing to ship binary blobs (as Debian does), which creates some trouble for Debian, but also creates some trouble for the hardware vendors who now have customers avoiding their hardware because it involves more trouble than a competitor's hardware. The typical response to this is the argument that not enough people run these operating systems to make the hardware manufacturers care, so you do more harm to yourself than you do to them. But that's ignoring the demographics. The primary constituency of Unix-like operating systems is the likes of IT professionals, systems administrators and software developers. These are the people who buy computer hardware by the pallet. Hardware manufacturers do not want those people to notice them in a bad way. This is incidentally why the state of open source GPU drivers is so much worse than the state of e.g. open source network drivers. When the local BOFH goes to buy a thousand rack units of Debian servers, he generally cares a lot more about the NIC than whether it will do 3D hardware acceleration. But that's going to change soon enough as GPGPU gets popular in the datacenter.
- ori_b 13y ago
  The difference between HW RNG and binary blobs is that the computer loses no functionality without an HW RNG, although it might suffer slightly in performance. Pragmatically, this is a huge difference.

Yes, and?

by tachion 13y ago

Yes, and?

I think he is saying, that FreeBSD ships binary device drivers - how can we trust that those do not compromise the system? If FreeBSD is open source - why are not the device drivers? If we can not trust FreeBSD for these device drivers, then why should we trust their opinion on using intel for a crypto source?

matthewmacleod 13y ago

The point was obviously that it's surprising to see that they are happy to ship binary drivers (which could contain arbitrary compromises from a user's point of view) but are not willing to trust the HWRNG (to which the same caveat applies). Of course, I don't agree with this comparison; running the output of the HWRNG through Yarrow is good practice in any case.

AnthonyMouse 13y ago
What's the problem with the comparison? The only real advantage of the binary blob over the hardware is that you can theoretically verify what it's doing more easily. But actually doing that verification has a difficulty on the same order as reverse engineering the driver to release an open source version, so all the existence of the binary driver does is to imply that such verification hasn't occurred -- because if it had then those doing the verification would have been in a good position to release source code (or at least complete hardware documentation) for an open source driver. Binary blob software also has the distinct disadvantage that even if you were to verify it, you would have to verify each release again whenever there is an update.
- tachion 13y ago
  In my perspective, binary drives are a matter of choice, you can use them, but you dont have to, if you dont want to, whereas the random numbers generation is used everywhere in the OS, and you cant just decide to not to use it - that's a huge difference, what makes this comparison bad.
  - AnthonyMouse 13y ago
    Can't you though? We're really talking about defaults here. If you don't want to use the hardware RNG, you can always disable it in either the BIOS or the OS. Or use hardware that doesn't have one. The trouble is for the common user who doesn't know anything about any of this and is just going to take the defaults for everything, who is exactly the sort of person who is going to take the binary driver to "just make it work" and then be exposed to any vulnerabilities it may contain. You have to make the defaults secure because they're what most people will use. It doesn't matter that you can change it if most people never do.
- matthewmacleod 13y ago
  Sorry, I was unclear. It's an apt comparison in that sense (it's unverified). However, there's a zero-impact workaround for this (using the CSPRNG on top of the HWRNG) so it has no user impact, whereas eliminating binary blobs does.
- pbsd 13y ago
  The comparison is ludicrous. Non-obfuscated binaries, often with debug symbols, are much easier to reverse-engineer and analyze than hardware. Additionally, you can analyze binary diffs, much like source code. You would not start from scratch at each new version. Let's also not forget how hard it is to verify source code, and how very rarely it is done.
- nucleardog 13y ago
  You're right in an academic sense - they're completely comparable. In reality, the difference is that we can guarantee 100% of systems to work without the hardware RNG. Every binary blob we remove removes support for hardware and 'breaks' the OS for a subset of the users. No one* is going to fire up an OS and go "Hey, this OS doesn't use my hardware RNG! This OS is broken!" They will, however, fire it up and go "Hey, this OS doesn't support my network adapter! This OS is broken!" Security versus functionality. It's always a trade-off. The most secure system is the one that does nothing - everything past there is adding functionality at the expense of an increased attack surface. * To within a margin of error.
  - AnthonyMouse 13y ago
    I don't know if they're that much different. If you turn off the hardware RNG then generating random numbers becomes significantly slower. Maybe most people don't care, but I expect most people also don't care if their network card doesn't do TOE as a result of you shipping an open source driver that isn't feature complete rather than a binary blob driver that is. The flaw in your argument is the assumption that the drawback of using a software RNG instead of a hardware RNG is inherently less than the drawback of using an open source driver instead of a proprietary binary blob driver. There may exist specific circumstances where this actually the case (as is obvious if there is no open source driver whatsoever), but that isn't the immutable state of the world. If you take this kind of security to be a Serious Issue then it demands for engineering effort (or community pressure) to be directed toward the goal of having published source code for all hardware drivers. One of the ways you can do that is by refusing to ship binary blobs (as Debian does), which creates some trouble for Debian, but also creates some trouble for the hardware vendors who now have customers avoiding their hardware because it involves more trouble than a competitor's hardware. The typical response to this is the argument that not enough people run these operating systems to make the hardware manufacturers care, so you do more harm to yourself than you do to them. But that's ignoring the demographics. The primary constituency of Unix-like operating systems is the likes of IT professionals, systems administrators and software developers. These are the people who buy computer hardware by the pallet. Hardware manufacturers do not want those people to notice them in a bad way. This is incidentally why the state of open source GPU drivers is so much worse than the state of e.g. open source network drivers. When the local BOFH goes to buy a thousand rack units of Debian servers, he generally cares a lot more about the NIC than whether it will do 3D hardware acceleration. But that's going to change soon enough as GPGPU gets popular in the datacenter.
ori_b 13y ago
The difference between HW RNG and binary blobs is that the computer loses no functionality without an HW RNG, although it might suffer slightly in performance. Pragmatically, this is a huge difference.