3 ms·

Do you have objections against the attack surface argument? Do you think that running a full-blown OS in a virtual machine is much better than a small dedicate

Do you have objections against the attack surface argument? Do you think that running a full-blown OS in a virtual machine is much better than a small dedicated OS? Do you think that overhead of userspace isolation is justified for a single task in a virtual machine?

peterwwillis 12y ago
Sure. First of all, lowering attack surface is the least intelligent way to improve security. It's like you have a house with a lot of windows that people could break into, so you cut the house in half to reduce the number of windows. What works much better than that is auditing and hardening the security of the house and its windows and making strategic decisions about how they work. For example, many people argue you should remove compilers from your system so attackers can't compile exploits on the host. But now the attacker can just push code there, or try a bunch of code in trial-by-error. Other people argue that any piece of software that isn't necessary should be removed, in case one of them has a vulnerability that could be used against you. Those vulns (for example, priv escalation vulns) could be eliminated by a simple audit of permissions, MAC rules or hardening patches, which would also drastically increase the overall security of the system. But people pick what appears like a simple solution because they don't want to think about it. I think you use the tool that works for your use case. If you were designing flight control software for the space shuttle, a whole virtual machine + OS might be overkill for your application, because you have a very specific set of operations to deal with and you need it done in a very specific environment, and you probably won't need to dynamically allocate extra resources in the middle of flight. On the other hand, if you're just serving static http content, your requirements are very minimal so you can use just about anything. Any OS, any web server, any content provider, any security configuration, etc. Due to its very narrow set of operations and few requirements, it's really easy to secure no matter what you use. In this guy's case he could have just read a book on SELinux and written a policy for a ridiculously secure web host over a weekend. Instead he's using some obscure bleeding-edge pseudo-operating system which he'll probably never use for anything else once he realizes how impractical it is, and getting marginal (if any) security benefit. He even admits he DoS'd it by accident. The only reason he's doing this is he thinks it's retro and cool.
- alricb 12y ago
  Actually, if what you want is to avoid heat loss, reducing the number and area of windows is a pretty good strategy. Simpler (picture) windows are also easier to secure than complex ones that can be forced open. It's the same with roofs: want to avoid leaks? Make your roof as simple as possible, with as few penetrations as possible. Very large, complicated projects are harder to audit, to the point of infeasibility (OpenSSL in its pre-heartbleed form comes to mind). Originally, a lot of people who were against "software bloat" (like Wirth with Oberon) did it because they wanted to run stuff on affordable computers (minicomputers rather than mainframes in the 1970s, microcomputer rather than workstations in the 1980s). That reason disappeared thanks to computing power. But now, with the internet as Serious Business where attackers create a constant barrage, it doesn't make much sense to run a "full OS" created for minis and workstations when all you want to do is serve some Web content. Unix-as-a-server-OS is a historical accident borne of the BSD implementation of TCP/IP and the usefulness of Unix-running hardware in the early days of the net.
  - acqq 12y ago
    Yes, one wonders why peterwwillis hasn't, as he suggests as an easy approach, "audited" OpenSSL himself and found the heartbleed in process. And that "over one weekend." Speaking of OpenSSL there's even this: http://openmirage.org/blog/introducing-ocaml-tls http://openmirage.org/blog/introducing-ocaml-tls Transport layer security (TLS) in pure OCaml, useful for MirageOS.
    - peterwwillis 12y ago
      You don't have to audit code to find security holes in an operating system. You audit the operating system. This is not rocket science, nor laborious.
      - acqq 12y ago
        Please do audit the Mirage OS as modified in the article and show what you find. I'm interested to see how you can claim that the OS which doesn't even have a file system, has only drivers for virtual hardware and not even code for starting a process isn't more secure than any other big solution. Above all, the code based on the functional language. It's closest to what we have to have a provably secure system.

peterwwillis 12y ago

Sure. First of all, lowering attack surface is the least intelligent way to improve security. It's like you have a house with a lot of windows that people could break into, so you cut the house in half to reduce the number of windows. What works much better than that is auditing and hardening the security of the house and its windows and making strategic decisions about how they work. For example, many people argue you should remove compilers from your system so attackers can't compile exploits on the host. But now the attacker can just push code there, or try a bunch of code in trial-by-error. Other people argue that any piece of software that isn't necessary should be removed, in case one of them has a vulnerability that could be used against you. Those vulns (for example, priv escalation vulns) could be eliminated by a simple audit of permissions, MAC rules or hardening patches, which would also drastically increase the overall security of the system. But people pick what appears like a simple solution because they don't want to think about it. I think you use the tool that works for your use case. If you were designing flight control software for the space shuttle, a whole virtual machine + OS might be overkill for your application, because you have a very specific set of operations to deal with and you need it done in a very specific environment, and you probably won't need to dynamically allocate extra resources in the middle of flight. On the other hand, if you're just serving static http content, your requirements are very minimal so you can use just about anything. Any OS, any web server, any content provider, any security configuration, etc. Due to its very narrow set of operations and few requirements, it's really easy to secure no matter what you use. In this guy's case he could have just read a book on SELinux and written a policy for a ridiculously secure web host over a weekend. Instead he's using some obscure bleeding-edge pseudo-operating system which he'll probably never use for anything else once he realizes how impractical it is, and getting marginal (if any) security benefit. He even admits he DoS'd it by accident. The only reason he's doing this is he thinks it's retro and cool.

alricb 12y ago
Actually, if what you want is to avoid heat loss, reducing the number and area of windows is a pretty good strategy. Simpler (picture) windows are also easier to secure than complex ones that can be forced open. It's the same with roofs: want to avoid leaks? Make your roof as simple as possible, with as few penetrations as possible. Very large, complicated projects are harder to audit, to the point of infeasibility (OpenSSL in its pre-heartbleed form comes to mind). Originally, a lot of people who were against "software bloat" (like Wirth with Oberon) did it because they wanted to run stuff on affordable computers (minicomputers rather than mainframes in the 1970s, microcomputer rather than workstations in the 1980s). That reason disappeared thanks to computing power. But now, with the internet as Serious Business where attackers create a constant barrage, it doesn't make much sense to run a "full OS" created for minis and workstations when all you want to do is serve some Web content. Unix-as-a-server-OS is a historical accident borne of the BSD implementation of TCP/IP and the usefulness of Unix-running hardware in the early days of the net.
- acqq 12y ago
  Yes, one wonders why peterwwillis hasn't, as he suggests as an easy approach, "audited" OpenSSL himself and found the heartbleed in process. And that "over one weekend." Speaking of OpenSSL there's even this: http://openmirage.org/blog/introducing-ocaml-tls http://openmirage.org/blog/introducing-ocaml-tls Transport layer security (TLS) in pure OCaml, useful for MirageOS.
  - peterwwillis 12y ago
    You don't have to audit code to find security holes in an operating system. You audit the operating system. This is not rocket science, nor laborious.
    - acqq 12y ago
      Please do audit the Mirage OS as modified in the article and show what you find. I'm interested to see how you can claim that the OS which doesn't even have a file system, has only drivers for virtual hardware and not even code for starting a process isn't more secure than any other big solution. Above all, the code based on the functional language. It's closest to what we have to have a provably secure system.