Linus Torvald called it out:"Why is this all done without any configuration options? A *competent* CPU engineer would fix this by making sure speculation doesn't happen across protection domains. Maybe even a L1 I$ that is keyed by CPL. https://lkml.org/lkml/2018/1/3/797
I want to see compartmentalized software and hardware. I for one do not trust Linus and I do not want to the type of idea that Linus Torvald is said to have said here by having lots of configuration options. I am no expert, but I would think that with optional parameters, an accidental, or, ill-willed toggle of an option can make an adversary easily abuse your computer. Why not just remove that possibility of abusing built in parameters by making sensibly sized modular code? It seems obvious that software ought to be more monolithic, such that the piece of software is compiled to your needs,
but also that one ought to be able to authenticate and recognize if a piece of software is:
1) properly coded (not a single instance of there being an omission of a ; character in the code for example, NOR, a single instance of there being a superfluous character in the code)
2) has the features you want and nothing more (at least as per the official guide)
3) Is secure against tampering (presumably, something that could be verified by means of some kind of authentication)
Afaik, one example of parameters being known to have been abused, is the fall back option of export ciphers using something called 'Dual EC DRBG', in which this patently flawed piece of crypto ended up being used by some, for "secuirty". The 'Dual Elliptic Curve Deterministic Random Bit Generator)' is also known as being a standard that was pushed by NIST, apparently after having been paid some millions of dollars by NSA, where one is now speculating that NSA paid NIST to have a vulnerability/backdoor built into computers/software.
https://en.wikipedia.org/wiki/Dual_EC_DRBGIf there is something I've learned about cryptography, it is that there are certain things you
must not have in your implemented cipher code design for sake of security, things like: a seed number acting as as hidden initialization vector for some piece of crypto math, hidden patterns, hardcoded numbers, dynamic numbers that reflect the date and mimicking other known data values, "home brewed crypto ciphers", and ofc, any other "up your sleeve" type of math/numbers. So far, the ideal is afaik one way functions, in which an error in just 1 bit is enough to transmute a cipher text into a seemingly random stream of 0's and 1's, and using prime numbers is afaik one way to do this to avoid trivial factorization of numbers, when also scaled to take into account what kind of computing power is required to scramble an encrypted message sufficiently, to not be decrypted in the next 10-20-50-100 years.
I think that at the very least, a secure method of communicating between a website is required, and even better if there are other ideas to authenticate valid webpages, code and software supposed to having been downloaded from a trusted supplier.
I personally think it would be a nice idea,
if only naively here, to get to have
software (code) turned into hardware, which you then can put checkers on with hardware only (something that just works and isn't subject to a never ending cycle of re-occurring updates), and that you can view/review with your own eyes by taking the hardware out and looking at it. I imagine some kind of thin circuit plate that can be inspected (at least for the critical parts, for sake of compartmentalization of running software on hardware, as opposed to building it all into some obscure package like a damn cpu). Maybe something that could also bridge hobby electronics with regular people I imagine.
Imagine having to now worry about hidden unseen connections in a transparent circuit board (as if one initially trusted to be able to see all the wiring paths in copper on the circuit board, and now having to worry about transparent copper or subtle doping with graphite material).
As long as severed flaws like Heartbleed happening (iirc someone being able to dump the server memory because of a flaw in the code used for networking protocols), there is imo no good point pointing a finger at how users are too dumb to manage their computer. I think it should be obvious that the industry is shit and "science" and "math" isn't there in the world as some existing and neutral party to it all to help out (and after all, the
implementation of code and things has to be good and flawless, and as Bruce Scheier have said, "you are the product" (think: corporations stealing and abusing your personal data). Ofc, I don't fully trust that guy either to be this neutral party, who I personally think of as being either too naive, and who apparently thinks that nation state espionage is just ok on a general basis, being on the record for having opined a broad sweeping statement that point out that the NSA is doing a job that he expects of them to do (or something to that effect, I don't have a quotation ready at hand), who by now should knowing well that NSA and the like is involved in shady stuff and also involved in killing people with drones on the other side of the Earth. And as I think I pointed out some other time here on the forums earlier, that guy met with congress in a hearing and simply agreed to the very general notion that innovation is very important but without explaining what it meant (and iirc the subtext for that piece of discussion was that the congress panel in that hearing had stated a problem of not wanting to create rules and regulations that would be at odds with 'innovation' (whatever that could mean, I thought of it as potentially wanting to avoid putting regulations for mass surveillance software/hardware and the way the internet allows for mass surveillance).
Home
Help
Search
Login
Register
