Veserv

70 ms·

871.
by Veserv 3y ago
Green Hills Software TimeMachine + History for C and C++: https://www.ghs.com/products/MULTI_IDE.html No particularly good publicly visible documentation of the functionality, but it does that and is a publicly purchas
872.
by Veserv 3y ago
A pretty good overview of open source solutions in the space. Missing out on one of the most useful areas for tracing which is time travel debugging. There are a number of interesting solutions there taking advantage of hardware trace, inst
873.
by Veserv 3y ago
Good old Monkey’s Paw truth. Technically true, but substantially false. It really should be fraud if you have to defend yourself in court by saying: “Well, technically…”. A marketing can be useful if it is meant to inform. However, a market
874.
by Veserv 3y ago
You have literally linked a press release stating a F-35 system upgrade program has chosen a COTS hypervisor. Still completely the opposite of your claim that the F-35 program has eschewed COTS RTOS middleware. For that matter, I have not u
875.
by Veserv 3y ago
That is a weird choice of example because the F-35 avionics software literally runs on Integrity-178. https://www.ghs.com/customers/lockheedf35.html
876.
by Veserv 3y ago
What a bizarre take. Basically every serious commercial and military aircraft design and systems upgrade in the last 20 years voluntarily uses a third party RTOS for basically all critical flight systems demanding a DAL Level A certificatio
877.
by Veserv 3y ago
From what I remember, it does not. I think your legal counsel did a overly-broad reading of some clause or combination of clauses. Given that you keep bringing up open source and mentioned code that you yourselves open sourced, it was proba
878.
by Veserv 3y ago
That is just plain untrue under any lay interpretation of your statement. Are you perhaps talking about not being able to open source a work statically linked to proprietary libraries (with or without library source code) such as compiler l
879.
by Veserv 3y ago
Because the entity doing the certification has access to the source code (if the certification is worth anything at all) and if you really do not trust the certification body you can usually just pay extra for access to the source code with
880.
by Veserv 3y ago
You can see the SKPP certification requirements here: https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_h... You can see the Security Target specification and how it conforms here: https://www.
881.
by Veserv 3y ago
Oh great, so they were advertised a product description and the fine print waived the entire product description and tossed out every verbal promise. In what universe is that anything other than intentional, bad faith deception? If somebody
882.
by Veserv 3y ago
Yep, that is the point of the first phase. The next phase is going to be attaching liability for incomplete SBOMs. The way it will likely play out is that if you were breached due to a undisclosed component in a purchased product the produc
883.
by Veserv 3y ago
Like literally every other engineering discipline, it should be considered software engineering malpractice to use a component that is not guaranteed to be fit for purpose or that you have not audited to be fit for purpose. If that means yo
884.
by Veserv 3y ago
A SBOM is for the producer at this time, not the consumer. It is about requiring the producers to at least try to figure out what they put into your soup. The sort of engineering 101 processes that almost all software development lacks. It
885.
by Veserv 3y ago
Oh great, the Tesla Safety report [1]. Can you let me know where in that “exhaustive” report I can find the number of accidents or miles driven used in that calculation? You know, the numerator and denominator? You know, the sort of hard-hi
886.
by Veserv 3y ago
There are very good reasons why safety-critical products do not "move fast and break people". It is generally frowned upon in civil society to disregard safety and human life just to satisfy your curiosity and greed. I understand
887.
by Veserv 3y ago
The default assumption is not “everything is unhackable”. The burden of proof is on you/vendors to prove that a vendor can protect against commercial hackers. What, are we just supposed to assume that their product works until a exha
888.
by Veserv 3y ago
So you can not even point to any independently verifiable systems or even evidence that supports your claim that products from those vendors can be used to make high assurance systems. In the entire world, not even a single one. But, despit
889.
by Veserv 3y ago
First of all, I am not excusing how horrendous the 737 MAX failures were. They were a total failure of the safety regime. As I said, they were 100x-1000x worse than other planes which is a unacceptable safety regression. I am attacking the
890.
by Veserv 3y ago
Quibbling about how "perfectly secure" is impossible is a complete red herring. Yeah, using known techniques cryptography is not perfectly secure, it will just take billions of times longer than the age of universe and billions of
891.
by Veserv 3y ago
Yeah, great, name one actual high assurance system any of those vendors have actually deployed or that anybody has ever deployed using those products. Something that can protect against something simple like a team of 10 FTEs for 3 elapsed
892.
by Veserv 3y ago
Those are the talking points of the people who got us into this mess who have been systemically incapable of deploying or even developing secure systems. There is no absolutely reason to listen to the liars who have repeatedly promised secu
893.
by Veserv 3y ago
No, these systems are not secure in any configuration. There are exactly zero large scale commercial IT companies that can deploy systems that can protect against commercially-motivated criminal attackers let alone well-funded intelligence
894.
by Veserv 3y ago
The 737 MAX was not a "crude mistake". The failure mode was a multiple independent root cause sequence of low probability events. If I remember correctly there were about 200,000 flights before it was grounded after two airframe l
895.
by Veserv 3y ago
"Roberts had previously told WIRED that he caused a plane to climb during a simulated test on a virtual environment he and a colleague created, but he insisted then that he had not interfered with the operation of a plane while in flig
896.
by Veserv 3y ago
Compared to a standard economically motivated criminal hacking business that will certainly attack any commercial deployment (i.e. the default threat model). Security exists relative to your attackers, not compared to other security solutio
897.
by Veserv 3y ago
If you want to see how good their self driving technology is now you can watch the highlights of a typical drive by one of the most fervent supporters: https://twitter.com/elaifresh/status/1727889381309239731 Only
898.
by Veserv 3y ago
https://archive.computerhistory.org/resources/access/text/20... Oral History of Les Kohn, one of the two designers of the NS32000 microarchitecture (the other being Dan O'Dowd). He discusses it and the X
899.
by Veserv 3y ago
There is no meaningful security difference between commercial operating systems and hypervisors when considering technically competent, commercially-motivated attackers. No systems built on such insecure systems can stop even minor attacks
900.
by Veserv 3y ago
That is just infinitely worse than calling write() on a file handle like a regular application. The hypervisor + OS + application model is stupid. The hypervisor and OS are duplicative. If you can rewrite the application (as is needed for

More ›