The bank has the best doors, the best locks, and the best cameras, and it is patrolled by a guard who props the doors open to so he doesn't have to keep fooling with the locks and points the cameras the other way to extend his smoke break. SeL4 would be another system used by humans.
It's always possible to break a perfect system by moving an additional layer of abstraction outward, and attacking one of the assumptions upon which it's built. Some of our era's highest security systems - game consoles - have been broken by undervolting them until the logic failed.
It's often possible. But not all systems are vulnerable to undervoltage attacks. For example, I don't think the iphone secure enclave is vulnerable to this.
And good security uses "defence in depth". Multiple layers which each individually need to be compromised to break the whole thing. To hack chrome, you need a vulnerability in the renderer or VM. Then you also need a sandbox escape, and a way to use that to attack the browser's parent process. This is much harder to do.
I'd stick with always. Defense vs offense in anything reasonably complex suffers from one issue that simply cannot be overcome. To defend, you need to defend against every single possible imaginable attack, from now until forever. To attack, you need to find a single attack that works. And on a practical level all systems need to be accessible by somebody, yet that somebody is himself also now a part of your security structure and is never going to be 100% reliable, both in terms of corruption and incompetence.
> not all systems are vulnerable to undervoltage attacks. For example, I don't think the iphone secure enclave is vulnerable to this.
Then there's decapping / depotting, a world of different types of microscopy - some destructive some not, directed EM attacks, etc.
> And good security uses "defence in depth"
And automation has enabled "offense in depth"
> To hack chrome, you need a vulnerability in the renderer or VM. Then you also need a sandbox escape, and a way to use that to attack the browser's parent process.
Or you just phish the user into installing your exploit. There's always another layer. Always a potential exploit. Because ultimately the same properties of the universe which permit computation within a closed system allow for predictably observing and influencing it. The expense and hassle of doing so are widely variable, of course.
> There's always another layer. Always a potential exploit.
So what? Most attackers aren't nation state adversaries. They're some kid in Wyoming messing around with deepseek. We live in a world where most exploits happen because someone was running an unpatched, 8 year old copy of wordpress. Because they put their insecure mongodb instance on the open internet. Because they used admin / "12345" as the username and password. We don't need to make hacks physically impossible for a nation state adversary. Just really, really difficult and expensive to pull off.
Honestly. If people talked about physical security like they talk about computer security, you'd have people telling you that, because walls can be physically smashed through, they don't bother locking the front door to their house.
> Honestly. If people talked about physical security like they talk about computer security, you'd have people telling you that, because walls can be physically smashed through, they don't bother locking the front door to their house.
Sure, but also if there are a dozen bikes locked to the rack all costing $1000 and a $500 bike just sitting there completely unlocked, the average thief is probably gonna take the cheaper unlocked one and ride away.
It’s not hard to get into a garage but it’s really easy to steal a lawnmower if you leave the door open all night. I wouldn’t call that thief honest but even the minor deterrent of closing the garage was enough to make you not the target.
How many locked doors have easily breakable glass windows right next to them, nevermind breakable walls? What we need is a red-team waiver, and an AI model, and a budget, and say something like: your site has to be unhacked by the HackerAI3000 bot after 2 days on a 5090 Nvidia GPU.
I once worked on AUD 450M banking project, the root password was kept in a kickstart file and unchanged, root SSH was allowed. The bank didn't care until I told the external security auditor who included it as part of their report.
Decades ago, I worked in a bank in an old building. The door had a card reader for access. You boop your card and the door opened. People would hold the door open for each other all the time out of politeness, even when they didn't know each other. Security told us not to do that, but it's hard to convince people to stop being polite.
I had a laptop stolen from my desk in a place like that once. (Not a bank - but similar door-card reader system). This guy came in in the middle of the day, wearing overalls. He confidently walked through the door after someone, like he belonged there. He walked up to my desk, swiped my laptop and just strolled out.
At the bank, they've replaced the door with mechanical gates and a security guard. The gates - physically - only let one person to walk through at a time. You can't hold a gate open any more. And the security guards stop anyone who tries.
Is it 100% foolproof? No. But it's way more secure. It would have stopped that laptop thief.
There's this pernicious, defeatist attitude that if you can't make a system 100% secure, so you shouldn't try. That's misguided. Most systems can be made orders of magnitude more secure than they are today. It just takes a bit of care and work.
Fine. Make the universe work for it. The whole system becomes more resilient as a result.
Look at our immune system. Incredibly complex and clever, and able to keep us alive in the face of all sorts of pathogens. It exists because of this cat and mouse game, played over millions of years.
There's people in the highlands of PNG who regularly eat each other. Of course, many are thought to have died due to prion diseases. But now these tribespeople seem to have become largely immune to prion disease. Incredible.
It explicitly mentions Kuru as "prion disease", it ignores that the mortuary practice of eating various parts of respected dead has long passed in time .. although the lingering effect on the woman and children that ate portions of the brain in the 1970s, early 1980s, is still residual in a very few.
From an evolutionary PoV a perfect defence is overkill - with two separate defences against prion diseases in that region it's only the rare variation that causes any issue - and that rarely occurs before a new generation is birthed - ie. 'perfect' from the PoV of the selfish genes.
The claim is that people in PNG are "largely immune" to these diseases, where kuru shows that they are not, and the "cure" was a stop in the practice, not some evolutionary upgrade
They are largely immune to Kuru - the number of people that could contract it (ie. the number who ate brain) was significantly larger than the number of people who actually did contract it.
The resistance came about via two separate "evolutionary upgrade"(s).
It was specifically endemic to the Fore, not so much to the Yate and Usurufa, and not particularly at all to other highland people in the general region.
There's a twofer that skittled the Fore, a ~1900 mutation that created a new form of infectious prion proteins, and a local variation that saw less uptake in the Fore of a resistant prion protein (alongside other resistant prion protein).
So, over the highlands region, there was general resistance thanks to several evolved variations, in one specific locale (the Fore) there was insufficient resistance to the mutation that hit a peak of 200 deaths / annum for about three years(?) in the late 50s.
I can't speak to "the literature", I just had a lot of conversations with the people on the ground (Mike Alpers, etc), on again / off again, since the mid 1960s.
What seems obvious to you doesn't seem obvious to me. I'm not a malicious or incompetent enemy. But you will need to explain your perspective for me to understand it.
By the way, there are countless ways to account for humans. There are entire branches of engineering devoted to this. If you don't want someone to leave the bank with a pen customers use for signing checks, you just chain it to the desk. If you don't want the installer to forget to put the pen-chain in, make a photo of the chain part of the checklist required to get paid. If you want to... etc.
The idea is that you determine an acceptable level of risk, then secure to that level. Maybe the acceptable level of risk chosen by companies is wrong. Maybe we need to increase that risk exposure via heavier fines and regulations. Maybe the cost of reducing that risk is too high already. Maybe we need to fund that. Maybe it's too confusing and we need to research better standard practices. I dunno. But this is not some unsolvable problem.
Ask anyone seriously involved in security - whether computer science related, or in general.
A thought experiment:
Think about the most important secrets a country can have - now think how they are still discovered by competing countries, enemies, etc.
As long as there are humans in the loop there is a known weakness.
We know about many famous cases of leaks - like the USSR stealing notes from the manhatten project. But I bet there are thousands of secrets which remain secret. We just don't actually know about them, because, y'know, they're kept secret.
Saying it's an update of this article. In case you don't like reading URLs, the newer blog post says Debian "wheezy" is worth $19 billion.
I consider this a simplistic analysis, because a closed-source Linux with a straightforward monetary pricetag would be worth a lot less in practice, since it would cease to be the de-facto OS for pretty much all new hardware products. Like BSD before it, which got ported to most workstations because it was freely available, Linux derives a good deal of its value from the fact you can port it to anything that doesn't run away quickly enough without having to pay money or even negotiate to license it from anyone.
Also, this pinged a few neurons deep in my memory, so I found what it made me remember. Back in 2004, some random named Jeff V. Merkey tried to buy a special license to the then-current kernel for $50,000.00:
> Also, this pinged a few neurons deep in my memory, so I found what it made me remember. Back in 2004, some random named Jeff V. Merkey tried to buy a special license to the then-current kernel for $50,000.00:
> In response, Molnar did some quick sloccount math and estimated the kernel as being worth $175,974,824 at that time.
Absolutely.
Just to clarify: Molnar first did the quick sloccount math and estimated $176 million USD. However, Molnar used the estimation values appropriate for an application.
But in fact, operating systems kernels are known to be more difficult to develop than typical applications. So I used the same approach but refined it to use parameters appropriate for a kernel. The article https://dwheeler.com/essays/linux-kernel-cost.html is really a response to Molnar's work; he did a rough estimate, I did a slightly-more-refined estimate. Those additional tweaks resulted in a higher redevelopment cost of $612 million (USD). Which gave the $50,000 offer an even bigger contrast.
The real point was that, even if it would have been possible accept $50K, it was absurdly low. You could argue about the estimate for a factor of 2, or 10, or even 100, and it still wouldn't change anything. Merkey was free to lowball a proposal, but that doesn't mean it should be accepted :-).
There was a 2004 article about this in LWN.net. LWN.net, and many others, don't see how such an offer could have been legally enforcible anyway, since you'd have to get the agreement of all the kernel contributors: https://lwn.net/Articles/106353/
To me, the kernel offer was more of an opportunity to find a way to measure the size of a kernel in a way that matters to people. Lines of code, or bytes on disk, don't really mean much to most people. Money... does :-).
in fact, operating systems kernels are known to be more difficult to develop than typical applications.
I'm not convinced. The core OS kernel code, sure; but more than half of the Linux kernel is drivers, and those are not just applications but separate applications; a change in an Intel wifi driver is unlikely to interact in any way with the nvme driver.
> I'm not convinced. The core OS kernel code, sure; but more than half of the Linux kernel is drivers ...
I agree that more than half of the Linux kernel is drivers. In fact, in my analysis of Red Hat 7.1 at https://dwheeler.com/sloc/redhat71-v1/redhat71sloc.html I found that 57% of the Linux kernel was in the drivers subdirectory. Obviously that varies over time. So I completely agree with that part!
> and those are not just applications but separate applications; a change in an Intel wifi driver is unlikely to interact in any way with the nvme driver.
They aren't really separate applications, though. More importantly, that's not the primary effort (and cost) driver for this effort estimation model. I used the COCOMO model, an effort estimation model that was publicly available and widely used at the time. I then applied its rules to the Linux kernel of that time, as best I could. I discussed every parameter I set, and why, here: https://dwheeler.com/essays/linux-kernel-cost.html
Here are some of the reasons why kernel code takes more effort, per the model:
* It inherits some of the general challenges of writing embedded software. There's very little in the way of a safety net (this is the safety net), and it's closer to the bare metal. You're writing in C (or later in Rust), not a language that shields you from many challenges. In COCOMO parlence this code is "semidetached".
* RELY: Required software reliability: High (1.15). The Linux kernel developers care a lot about reliability, which takes longer.
* CPLX: Product complexity: Extra high (1.65). "The kernel must perform multiple resource handling with dynamically changing priorities: multiple processes/tasks running on potentially multiple processors, with multiple kinds of memory, accessing peripherals which also have various dynamic priorities. The kernel must deal with device timing-dependent coding, and with highly coupled dynamic data structures (some of whose structure is imposed by hardware). In addition, it implements routines for interrupt servicing and masking, as well as multi-processor threading and load balancing. And yes, that includes drivers; drivers must handle threading and other challenges that "normal" code doesn't, because the driver code is where those complexities are handled."
* TIME: Execution time constraint: High (1.11). "Although it doesn’t need to stay at less than 70% resource use, performance is an important design criteria, and much effort has been spent on measuring and improving performance."
* VIRT: Virtual machine volatility: High (1.15). "The most common processor (x86) doesn’t change that quickly, though new releases by Intel and AMD do need to be taken into account [but] the other components of underlying machines (such as motherboards, peripheral and bus interfaces, etc.) change on a weekly basis. Often the documentation is unavailable, and when available, it’s sometimes wrong (which from a developer’s point of view looks like a volatile interface, since it keeps changing). The Linux kernel developers spend a vast amount of time identifying hardware limitations/problems and working around them. What’s worse, there’s a variety of different hardware, and new ones keep arriving... the interface of the underlying machine is actually quite volatile."
Not every factor makes things worse. The people analyzing it (ACAP) and developing the code (PCAP) are unusually capable, with high experience in the programming language (LEXP) and modern development practices (MODP). But these only partly compensate for the fundamental challenge of writing highly performant kernel code.
Anyway, that's my rationale. I did this back in 2004, so I was necessarily using data and models available at the time. Most importantly, I think its key point was absolutely correct: it would have cost far more than $50,000 USD to re-develop the Linux kernel of that time.
They aren't really separate applications, though. More importantly, that's not the primary effort (and cost) driver for this effort estimation model. I used the COCOMO model, an effort estimation model that was publicly available and widely used at the time. I then applied its rules to the Linux kernel of that time, as best I could.
COCOMO says that the cost scales superlinearly with the number of SLoC; my point is that drivers scale linearly because they're effectively separate projects. (In fact, to the extent that they're not separate projects, the cost in fact scales sublinearly since there's a bunch of code being copied and pasted when new drivers are written.) Your tool has this "--multiproject" concept; a better estimate would have identified which parts of the tree (primarily drivers) were functionally separate from the rest of the kernel.
I think its key point was absolutely correct: it would have cost far more than $50,000 USD to re-develop the Linux kernel of that time.
Oh, absolutely. I'm not disputing the conclusion; just the claim that an OS kernel is inherently more complex than another application of the same size.
> COCOMO says that the cost scales superlinearly with the number of SLoC; my point is that drivers scale linearly because they're effectively separate projects. (In fact, to the extent that they're not separate projects, the cost in fact scales sublinearly since there's a bunch of code being copied and pasted when new drivers are written.) Your tool has this "--multiproject" concept; a better estimate would have identified which parts of the tree (primarily drivers) were functionally separate from the rest of the kernel.
If all drivers were essentially completely independent projects that never interacted with each others, then yes, I'd agree that multiproject would be a better model. And if each was mainly a copy-and-paste of another, then it'd definitely be sublinear.
However, I have a very different expectation. In the Linux kernel, there's a strong pressure to try to create common interfaces that different drivers support. There's also pressure to create common lower-level functions that everyone can call. This reduces total code and reduces long-term maintenance, but ends up creating more interlinkages because the drivers are NOT really isolated separate projects at all. Maybe the drivers start somewhat independent, though I'm skeptical of even that, but I think that's not at all where they stay.
Let's get specific. The Linux kernel groups similar hardware into distinct subsystems. This includes networking, input subsystem (keyboards/mice/etc.), ALSA (sound), V4L2 (webcams/video capture cards), and GPIO.
Each subsystem defines a unified programming interface using standard data structures and callback functions. Drivers are typically split into a core framework that handles general logic and low-level portions. Driver developers plug into the existing framework for common features like power management and buffering. These interfaces often change as new drivers are created that require changes to the interface.
Because in practice there's a lot of interaction among drivers, I would not expect that, after years of driver development, the different drivers would really be independent. Indeed, many have asked the Linux kernel developers to make it easy to have completely separate and isolated drivers, but the developers have resisted because they believe it's important to have the drivers integrated into the kernel to support that kind of constant collaboration between drivers.
It'd be cool to see an analysis to settle the question. Future research for someone else I suppose :-).
> I consider this a simplistic analysis, because a closed-source Linux with a straightforward monetary pricetag would be worth a lot less in practice, since it would cease to be the de-facto OS for pretty much all new hardware products.
It's necessarily an estimate, of course. The best way to get effort figures would be to record every minute used for development, and the best way to get cost figures would be to re-develop from scratch. That wasn't practical, so using a widely-accepted estimation system seemed like a reasonable approach.
It's true that this analysis doesn't tell you the purchase price. However, I wasn't trying to estimate the purchase price. I was trying to estimate the cost to develop the software, if it had been developed using traditional closed source practices. If Linux had been developed by a for-profit organization to make a profit, the organization would have planned on charging more that that (in aggregate among all its users), since otherwise they'd be knowingly developing the software at a loss. That doesn't mean that the company actually could have charged this, as it often happens that products don't make a profit, but that's different from intent. And this is all different from value. If a product has value to you that's more than it costs to get, then economically you should consider getting it.
No matter what, these time and money figures can only be rough estimates. However, I think they were useful, because they destroyed a false assumption many had at the time.
In the 1980s and 1990s many people presumed that large-scale systems could NOT be developed as open source software. People did sometimes share software, but it was widely assumed that this could only be successful for small programs. The term "open source software" didn't even exist until 1998. The term "free software" was coined in the early 1980s, so that definitely was a discussion point. However, many people didn't think you could build larger systems with software licensed that way.
Bill Gates published in 1976 his "Open Letter to Hobbyists" that crystallized this argument. He claimed that if software was freely shared it would prevent the writing of good software. He basically argued that closed source software development (not a term of the time) was necessary.
The point of my paper was to show that it was possible to build larger software systems without being closed source software. Even at the time, people were being paid to develop some of that software, but the point was that sharing of software under a generous license did not end software development at all. I think my paper did the job. You can argue many things, but no one argues that open source software cannot be used to build big systems. We have existing systems, measureably large, that refute the claim.
> the misses would rather have an induction burner, microwave, and an ice chest running off a solar panel.
Those would definitely be hits.
Also, solar panels are old. Bell Labs demonstrated the first practical silicon solar cell in 1954. At some point, you're just trying to split (possibly nonexistent) hairs for an aesthetic, as opposed to making a principled stand against technology.
There are many sans-serif fonts that distinguish the lower-l and upper-i. For some reason they aren't as popular as the ones that do not. Perhaps the popularity of Helvetica (and other neo-grotesque typefaces) caused this.
It isn't a hard drive. What's being driven, your mom? It definitely isn't a hard disk in most cases, either, because SSDs are so common.
It isn't a screen. What's being screened out? Is it a monitor? I don't know, is it? Are you monitoring things? If not, then it isn't.
It isn't a mouse. Mice have tails, and also are small living mammals with respiration and without buttons.
It isn't a touch pad. It is touched, but it's also stroked and tapped, so calling it merely a touch pad is inaccurate.
My point, of course, is that language is purely convention, and trying to nitpick all of those conventions quickly leaves us with nothing. There's polysemy and semantic drift and as long as there isn't confusion there also isn't a problem.
Forgetting the infelicities of Patrick Russ is reasonable because he's both dead and his estate isn't (to my knowledge) funneling money from the sale of his books to odious causes. Would that I could say the same about other authors.
"You get what you pay for" means if you buy proprietary software, you get software from proprietary vendors who act like modern proprietary vendors act these days, which is using every avenue to maximize profits. There's no recourse, because it is proprietary and, therefore, belongs to the software maker, and not you. It is not your property, it is theirs.
Which leads into...
"If you're the customer, you're the product" because customers are valuable products. You willingly bought the service, so your data is data from someone who is interested in the company and probably willing to buy more from it and its partners if the company can target you. Your data, therefore, has resale value, making you a product to be sold.
reply