Canal+ uses Ada but one is alleging that Canal+ suffered a crash today
with Windows. Cf. HTTPS://WWW.UniversFreeBox.com/article/568957/orange-canal-et-bouygues-telecom-annoncent-a-leurs-abonnes-etre-touches-par-la-panne-informatique-mondiale
Cf. a complaint by Mister Brukardt that Ada can not control non-Ada
software on a shared system.
It is about the fundamental principle that security
cannot be added on top of an insecure system.
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security
cannot be added on top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly insecure, yet
we are capable of running secure applications and protocols on top of it.
On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security cannot be added on
top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly insecure,
yet we are capable of running secure applications and protocols on top
of it.
Why on earth do we need security updates?
Do you update your screwdriver each week?
On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:
On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security cannot be added on >>>> top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly insecure,
yet we are capable of running secure applications and protocols on top
of it.
Why on earth do we need security updates?
Because computer systems are complex, and new bugs keep being discovered
all the time.
Do you update your screwdriver each week?
I don’t depend on my screwdriver to keep my bank account secure.
On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:
On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security cannot be added on >>>>> top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly insecure, >>>> yet we are capable of running secure applications and protocols on top >>>> of it.
Why on earth do we need security updates?
Because computer systems are complex, and new bugs keep being discovered
all the time.
This does not make sense. You can create a very complex system out of screwdrivers and still each screwdriver would require no update.
Systems consist of computers and computers of software modules. There is nothing inherently complex about making a module safe and bug free.
Security interactions are primitive and 100% functional. There is no difficult issues with non-functional stuff like real-time problems.
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
A problem that has been solved since 1983, and even before (Pascal had
bounds checking). Sigh...
On 2024-07-21 10:22, Dmitry A. Kazakov wrote:
On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:
On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security cannot be
added on
top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly insecure, >>>>> yet we are capable of running secure applications and protocols on top >>>>> of it.
Why on earth do we need security updates?
Because computer systems are complex, and new bugs keep being discovered >>> all the time.
This does not make sense. You can create a very complex system out of
screwdrivers and still each screwdriver would require no update.
Systems consist of computers and computers of software modules. There
is nothing inherently complex about making a module safe and bug free.
Security interactions are primitive and 100% functional. There is no
difficult issues with non-functional stuff like real-time problems.
Well, several recent attacks use variations in execution timing as a side-channel to exfiltrate secrets such as crypto keys. The crypto code
can be functionally perfect and bug-free, but it may still be open to
attack by such methods.
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
||<<< 550 #5.1.0 Address rejected." | |RCPT To:<lathrop@mcs.anl.gov> | |
On 2024-07-21 10:00, Niklas Holsti wrote:
On 2024-07-21 10:22, Dmitry A. Kazakov wrote:
On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:
On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:
It is about the fundamental principle that security cannot be
added on
top of an insecure system.
Actually, it can. Notice how the Internet itself is horribly
insecure,
yet we are capable of running secure applications and protocols on >>>>>> top
of it.
Why on earth do we need security updates?
Because computer systems are complex, and new bugs keep being
discovered
all the time.
This does not make sense. You can create a very complex system out of
screwdrivers and still each screwdriver would require no update.
Systems consist of computers and computers of software modules. There
is nothing inherently complex about making a module safe and bug
free. Security interactions are primitive and 100% functional. There
is no difficult issues with non-functional stuff like real-time
problems.
Well, several recent attacks use variations in execution timing as a
side-channel to exfiltrate secrets such as crypto keys. The crypto
code can be functionally perfect and bug-free, but it may still be
open to attack by such methods.
It is always a tradeoff between the value of the information and costs
of breaking the protection. I doubt that timing attack are much more
feasible in that respect than brute force.
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
Exactly. Non-functional attacks are hypothetical at best. They rely on internal knowledge which is another problem.
Security researchers and crypto implementers seem to take timing attacks quite seriously, putting a lot of effort into making the crucial crypto
steps run in constant time.
As I understand it, the "internal knowledge" needed for timing attacks
is mostly what is easily discoverable from the open source-code of the
SW that is attacked.
Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
A problem that has been solved since 1983, and even before (Pascal had
bounds checking). Sigh...
Considering many many layers of software to predict timing from code in uncontrolled environment would be a challenge.
On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:
Why on earth do we need security updates?
Because computer systems are complex, and new bugs keep being
discovered all the time.
This does not make sense. You can create a very complex system out of screwdrivers and still each screwdriver would require no update.
On Sun, 21 Jul 2024 11:10:06 +0200, J-P. Rosen wrote:
Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
A problem that has been solved since 1983, and even before (Pascal had
bounds checking). Sigh...
Pascal had no checking for memory leaks or double-frees.
Rust certainly seems to be a next-generation solution to these sorts of memory problems.
On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:
If you have a box full of screwdrivers, then all you have is a box full of screwdrivers.
If you have a computer system made up of a bunch of modules interacting
with each other, then you could have, potentially, quite a complex system indeed.
Look up the term “combinatorial explosion” to learn more.
On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:
If you have a box full of screwdrivers, then all you have is a box full
of screwdrivers.
If you have a computer system made up of a bunch of modules interacting
with each other, then you could have, potentially, quite a complex
system indeed.
Tight coupling = bad design.
Le 21/07/2024 à 23:53, Lawrence D'Oliveiro a écrit :
On Sun, 21 Jul 2024 11:10:06 +0200, J-P. Rosen wrote:
Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
But certainly, most attacks on SW have used functional bugs such as
buffer overflows.
A problem that has been solved since 1983, and even before (Pascal had
bounds checking). Sigh...
Pascal had no checking for memory leaks or double-frees.
Rust certainly seems to be a next-generation solution to these sorts of
memory problems.
We were talking about bounds checking, that Pascal had.
On Mon, 22 Jul 2024 09:16:09 +0200, Dmitry A. Kazakov wrote:
On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:
If you have a box full of screwdrivers, then all you have is a box full
of screwdrivers.
If you have a computer system made up of a bunch of modules interacting
with each other, then you could have, potentially, quite a complex
system indeed.
Tight coupling = bad design.
And yet you are relying on those systems right now. Do you do online payments/banking? You depend on those systems crucially for that.
On 2024-07-23 03:49, Lawrence D'Oliveiro wrote:
On Mon, 22 Jul 2024 09:16:09 +0200, Dmitry A. Kazakov wrote:
On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:
If you have a box full of screwdrivers, then all you have is a box
full of screwdrivers.
If you have a computer system made up of a bunch of modules
interacting with each other, then you could have, potentially, quite
a complex system indeed.
Tight coupling = bad design.
And yet you are relying on those systems right now. Do you do online
payments/banking? You depend on those systems crucially for that.
I don't understand your point. Should I bubble with joy each time it
crashes or gets compromised?
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 379 |
Nodes: | 16 (2 / 14) |
Uptime: | 44:35:01 |
Calls: | 8,141 |
Calls today: | 4 |
Files: | 13,085 |
Messages: | 5,858,054 |