Schneier on Security

tommy • June 9, 2011 4:01 AM

@ Nick P:

Sorry for the misunderstanding: I was agreeing with you that the figure was unprovable (and probably high, I should have said that), but that surely some are, whether it’s 1% or 5% or whatever. And if this FUD intimidates crooks, good.

Twice, my own credit card co. has called and notified me that my account has been canceled and replaced with a new # due to a major breach. (Once, after it had already been declined. Good thing I had cash with me, or I’d have been washing dishes. Memo to self back then: Never leave home without two different cards.) But no arrests, no publicity. Perhaps it was kept quiet in the hopes that anyone who bought the now-blacklisted numbers and tried to use them would be nabbed? IIRC, it was about 20k card #s once and 30k the second time. (I suffered no loss. Props to the card co.)

Agree that Abagnale was not a good analogy: He did prison time, then openly went to work for LE, banks, etc. Just saying that the plea-bargain, work-for-us concept, and the honeypot concept, are “credible” (pardon the pun). And the old saying, “Set a thief to catch a thief.” (mid-1600s British, US-ized to “It takes a thief to catch a thief”.)

And LOL at the hooker getting hooked – but since when do hookers take checks? (I wouldn’t know.) He was lucky her pimp or whatever didn’t find him and beat the **** out of him.

tommy • June 10, 2011 4:04 AM

@ Clive Robinson, Sorry We Cross-Posted:

Thanks for the explanation. However, the brain cells in my gut are telling me that adding any sort of graphic upload capability is a huge increase in bandwidth, disk space, and potential malice. Many posters have linked to an image to illustrate their points, and that’s easier, cheaper, and safer. I think flow charts of posts would be about as confusing as the present situation.

ChangeDetection.com will tell you when the page changes, but not eliminate unchanged data. I’ll bet between you and Nick P., you could come up with that page add-on that lets you query for changes since the last access by that IP (since there isn’t registration of user/pass).

tommy • June 11, 2011 2:24 AM

@ Nick P.:

“… I’m aiming for a somewhat secure design and minimalism is an important part of that.”

You mean, like when I said that my Windows folder was chopped by 95%, from 4 GB to 175 MB, and that a lot of MS patches are for files I no longer have? Yes, isn’t it funny how bloat increases attack surface, and “one man’s ‘feature’ is another man’s exploit”?

“Use the minimum resources necessary to accomplish the desired tasks, and no more”… We are on the same page, my friend. Looking forward to it, whenever.

tommy • June 13, 2011 12:56 AM

@ Nick P.:

Glad I’m not alone in my extremism. 😉

“…. Firewire DMA vulnerability by calling it a feature. It’s supposed to bypass the security mechanisms for performance.”

My whole machine would run a bit faster if it weren’t running AV; I can measure a tiny drop in speed of WPA2 vs. an unencrypted network; occasionally, I get firewall alerts; sandboxing the browser added a couple of seconds to the time to get the pdf’s to the desktop, where they were manually scanned, etc… We could get max speed by dropping all security, but what good is the performance boost when you’re compromised? You’ve given the pwners a faster machine, I guess. (sigh)

I see that I have some more interesting reading, just as the new week starts. When digested, do I reply to you here, even if this thread is no longer on the home page, or give you an O/T shout at whatever the latest thread or your latest post is, as before?

(See? Your Schneier Beta is necessary and useful!) … I’ll watch this thread until I know where to reply. Have a great week.

tommy • June 15, 2011 9:16 PM

@ Nick P.:

Thanks. Sorry, but with MS Patch Tuesday, I have to vet all the individual patches for the machines that either I own or help friends with (“Just Say No” to Auto-Update, given past disasters), so running a little farther behind than usual. Surely by this weekend… Quick first-glance at Poly certainly indicates that they’re people after my own heart: It’s much harder to make code safe than it is just to get rid of it.

tommy • June 17, 2011 12:57 AM

@ Nick P.:

No worries all around. I’ve long been aware of “Patch Tuesday” being followed by “Exploit Thursday”, as black-hats reverse-engineer the patches to see what the vulns were. It’s not surprising that someone managed to automate the process, thus shortening the safe harbor to hours vs. a day or two.

This is why that Tuesday is an ultra-high priority. I have the page bookmarked in advance; it’s always

www dot microsoft.com/technet/security/bulletin/msYY-MMM.mspx

where XX = 2-digit year and MMM = three-letter abbreviation for month.

I don’t particularly like things accessing the web in the background (I might be doing online banking, e. g.), so even auto-notification is off. Which means checking every couple of hours during the day, then when it’s published, dropping everything else and doing the fine-toothed-comb bit on them.

My machines are always taken care of before retiring Tuesday night, and the family/friends are either also taken care of, or sent a quick heads-up, e. g., “Eight vulns in Excel this month. Don’t open any except from the most trusted sources until we get the patch installed and verified.” … which is good advice anyway, but the rest of the family is non-tech. Unfortunately, that means some are still on IE, naive and not willing to change, greatly complicating and lengthening this task — I’m ashamed to admit that I have a sibling who uses (pardon my language) AOL.

So they’re all good to go not too late on Wednesday, at the latest, and have been given quick workarounds in the interim where possible. But this pushes everything else in life back by a day or two, so there’s some catch-up to do.

Your links are invariably fascinating, and deserve much more than a fast read-through. I’d like to set aside time to read, digest, assimilate, and form some kind of intelligent response, rather than a hasty “Good article, thanks.”

You’re practically a one-man library of papers of great insight. Keep ’em coming, but not too fast. ;-D … speaking of insight, the reply about Qubes to mashiara at the Android thread not only cut to the core, but reinforced what we’ve been discussing: putting a high-assurance OS on insecure foundations and hw is not a complete solution, and that we throw away the lessons that were learned decades ago.

btw, I doubt I’ve perused nearly as many tech blogs as you, but of the few I occasionally visit, I agree that this one has, overall, the highest-quality readership and discussions, and is at the top of the priority list for whatever time is available for such.

The papers are a top priority for this weekend, and I’m looking forward to them.

tommy • June 17, 2011 7:54 PM

@ Nick P.:

“Secure systems might function from top down, but security is built in from the bottom up.”

Plus, any chain is only as strong as its weakest link. Sad analogy: You build your high-assurance OS, with its tightly-locked kernel, with hypervisor supervision, on an ultra-secure CPU and other hw — and then have to log on to an Internet structure full of holes – spoofed or stolen SSL/TLS certs; corrupt ISP or Net infrastructure employee, blah, blah, blah … You at least keep your own machines from being compromised, but if you want them to talk to other machines from time to time ….

As we both know, the Internet as it exists today was never built for security (though they did an amazing job with reliability, for a new technology), because no one foresaw that the ability to connect to it would become commonplace in the majority of non-Third-World populations (and even some in those).

LOL at the “blog comparisons”! (I saw the gist of your “talk” with Joanna; hence, the comment.) But speaking as a strict logician (Aristotelian, not voltage-gated, lol), someone who dismisses an entire class or set of people without evaluating the merits of what’s said has committed at least two classic errors in logic: hasty generalization (“I’ve seen useless comments at blogs” => “All blog comments are useless”) and argumentum ad hominem in the plural (“This statement came from a blog commenter, not from a peer-reviewed research paper” => “It can’t possibly have any merit”.) To the logician, every statement stands on its own merits, regardless of who said it, or in what medium, etc.

btw, as this conversation continues and the thread is off the homepage (but into the bookmarks), that forum-like, thread-based model is sounding better and better, regardless of whether it’s hierarchical or in the classic PHPbb forum, where you can have subfora about each category of topic, and lists of threads inside, which may or may not bump from a new comment, as the admin wishes. Looking forward to that, but for the moment, this otherwise-abandoned thread suits our purposes. Have a great weekend, and a happy Father’s Day, if you have, or are, a father. Or even if not. 😉

http://www.amiright.com/parody/60s/thetemptations46.shtml

tommy • June 19, 2011 10:38 PM

@ Nick P.:

I’ve long been aware of the principle of least privilege; but off the top of my head, couldn’t have attributed it to Saltzer’s 1974 paper.

The Poly2 paper was both thoughtful and supportive of what I’ve been doing to try to tighten a COTS OS. (Win XP, although they cite vulns in FreeBSD and the Linux kernel, and confirm the consensus here at the blog that no readily-available OS is secure.)

” … application-specific (minimized) OSs” – Mine is getting pretty close to that. Sometimes, I have to restore a file to run a one-time-only tool, then re-delete the file. What’s there is what’s necessary to boot to Windows with a fully-functional GUI and the minimum of required support functions, and to support the apps I use.

“Removal of all other services reduces the functionality of the system to a bare minimum”.

Yep. All services not required have been disabled. A few are re-enabled on a per-need basis. Default start-up: 11 Windows core services; the rest are AV, firewall, browser sandboxing, wireless, printer and scanner (those two could be disabled until needed, but as local services, not accessible to WAN, no harm in running), and audio (could be disabled when not listening to music/video; I don’t need the bells going off all the time; and the volume is off most of the time anyway.) So, 18 services start by default. How many on your machines?

“Often these services are overlooked or assumed to be required for stable operation of the system”

Case in point: msconfig tells you that RPC Locator service is “essential”, yet it’s never running, and things are fine. Go figure… (RPC itself is required.)

Glad they acknowledged “Psychological acceptability”, since convenience usually trumps security.

“…the use of write-once and read-only media…”

I don’t boot from Live CD or anything, but the sandbox tool renders the entire HD read-only to the app being sandboxed (usually, the browser), and much valuable, but infrequently-used, data, as well as both system backups and data backups, are stored on CD/DVD. This was originally for economy of HD footprint, but it’s a good point that such things are much less vulnerable to attack or corruption than HD contents.

I can’t afford a separate machine for each application, and doubt most people could, although some here have suggested having one machine used only for banking or other high-sensitivity activities, which is never otherwise online, and using another for the rest of normal browsing.

Separation of types of traffic is more applicable to an enterprise LAN than to a sole user like myself, but it’s an interesting idea. If only those designated as Admins can access the LAN admin network, that’s a huge gain for security of the rest, and shrinking of real attack surface — the attacker has to compromise that particular network, which of course is strongly hardened, in order to attack the systems themselves, as opposed to being able to get any one worker to click on a malicious link or attachment, etc. The latter has no privilege to affect the system, only to use it per need.

“Internal communications authenticated and encrypted” – My WPA2 does that, even in using the remote (next room) printer/scanner, but I’ll bet very few enterprises have implemented that. Once introduced, which shouldn’t be too expensive, it seems the CPU and bandwidth costs would be small, for a large gain. No employee training needed, beyond the ever-vexing problem of lending or leaking of pw, pasting it under the keyboard, etc. Weak choices of pw could be automatically rejected, as some online banks are finally starting to do.

I like the two-person integrity controls for modifying security policy and enforcement, but companies will scream. So, just empower several qualified and vetted individuals with this authority. Now, an attacker has to break and impersonate two different persons instead of one.

“The goal is to minimize a general-purpose OS such that it supports only those specific services that are supposed to run on a system,”

For services that I think I’ll never use, the support files are deleted, though not unregistered. Thus, if later the service is in fact needed, merely restoring the associated file(s) enables quick start of the service.

For the abhorrently dangerous (RDP, UP’nP), the reg keys are deleted also, so that they no longer even appear in the Services window. All backed up and catalogued, of course, so readily available if restoration is needed. An attacker obviously can’t use these protocols to attack my setup, but if he gains access other ways and would like to enable them to create additional channels for future attacks, he’s got a lot more work ahead of him than most attackers would likely suspect, no?

“A combination of ARP, IP, TCP, UDP, ICMP, and DNS is sufficient to provide the necessary network communication support. … Additional areas in which protocol stripping will be useful include ARP and DNS. The physical addresses of all machines are known and do not need to be resolved dynamically”

Way ahead of you, guys. The DNS service was disabled and removed, as was ARP.exe and the ARP drivers, since my ISP does DNS lookups for me. The router keeps its own table of LAN clients without needing Windows components or services.

“An application binary and its dependencies are the only essential components for an application to execute on a system….. .All other code on the system is superfluous.”

Thank_You,_Sirs, that is exactly what I’ve been aiming for. The rest of Sec. 4.2 is aimed at their single-application-server model, not directly applicable to my case. I have followed 1) and 2) by removing as many utilities and libraries as possible. The only chat client is AES-256 secured, and not normally running except when in use, on a VPN whose access I control, via both password and affirmative approval of any new users. (rare). Windows Management Instrumentation (WMI/WBEM) has been removed, as the information provided does not seem to be missed. Some warn of disaster if you delete this. Didn’t happen here.

%windir%\system32 currently has only 272 dll’s, about a thousand less than originally, and other file types have been similarly cut. Especially ActiveX (.ocx), of which only one remains, and that one is needed for the simplified Win Media Player 6.4.

I’m not going to mess with system calls and library functions, but if they can implement their proposal, great. As far as kernel reduction, I’ve already found that I can do without ntkrpamp.exe, and in fact, I could cut ntkrnlpa.exe if it weren’t for the fact that DEP requires it, and I like the additional defense-in-depth of DEP. Still, that’s about a 25% reduction in kernel exe size.

I didn’t run their complex Vulnerability Metrics formula, since my system is a single-user vs. large multi-user with their independent servers, etc. In terms of Total Lines Of Code in Sec. 5.1, I haven’t counted the lines :), and doubt that the number of files cut is linear to number of files deleted, because many essential files – the 2MB kernel exes, e. g., are probably a lot larger than average. But footprint is a reasonable approximation of that, I think, and so shrinking the size of the Windows folder by about 95% should presumably cut the TLOC by something reasonably close to that.

Mitigation of Attacks: (Sec 5.2) Presumably, a Web-based exploit of any vulnerability cannot write outside of the browser’s sandbox, which is emptied regularly. The only other Web-facing apps are the AV and firewall themselves. E-mails are read in plain text only; attachments are auto-scanned for viruses before d/l, and again before opening, along with Best Practices regarding unknown sources. If it’s necessary to open an uncertain document, it too can be opened inside a sandbox, where malicious contents cannot write to the HD.

Sec. 6.1 Intrusion: The router and firewall prevent unsolicited inbounds and severely restrict outbounds, with UP’nP also disabled in the router. WAN pinging is prohibited, as are IDENT on Port 113. NoScript’s ABE function

http://noscript.net/faq#faqsec8

prevents WAN requests from accessing/attacking LAN resources. The firewall opens no ports except as required for the browser for HTTP, HTTPS, etc., and only when internally requested. All ports are invisible to unsolicited outsiders.

Sec. 7.5: “Hardened OSs such as TrustedBSD, Security-Enhanced Linux (etc.). typically add new security mechanisms, replace existing modules with more secure ones,… Although Poly has similar goals, the means of attaining them are not through addition of more software … but by removing unnecessary software and functionality.”

Right up my alley.

Thanks for the paper. The Qmail paper’s response should come a little more quickly with all the Patch Tuesday stuff out of the way, and what looks like a fairly light week ahead, so far.

Nick, I don’t see this approach and the various approaches you’re taking as being XOR to each other. You’ve already come out in favor of minimalism for the Schneier Blog Beta, and surely that will be incorporated in your ultimate high-assurance system.?

What do you think of what I’ve done in trying to harden a Swiss-cheese OTS system?

(Nick P.) “This is why things like cross-site scripting attacks … are on my radar.”

Nick, I think you really should take a new and exhaustive look into NoScript and the capabilities that have been added since you last looked, or may never have been aware of. NS prevents XSS attacks and many others by default, OOB, no user config or action required, even if scripting itself is allowed globally.

Thanks for the kind words on the song. My own favorite misheard lyric, which I myself misunderstood for many years, was from “Groovin’ ” by The Rascals.

Actual line, improperly stressed:

“Life would be ecstasy, you and me endlessly … (groovin’)” .

The meter required them to stress “less” in “endlessly”; hence, it sounded like:

“Life would be ecstasy, you and me and Leslie… (groovin’)”

Sounded like a kinky threesome to me, and inspired a parody on that exact premise.

http://www.amiright.com/parody/60s/therascals11.shtml

I’m not familiar with the song and band you cite, but will check it out.

btw, as a trivial joke, took the original lyrics of Sinatra’s “Strangers In The Night”, scrambled the phonemes in each line, but kept them all there, and it came out readable and with some serendipitous funny lines, like

Glove was just a lance away
and
Oven for liver

http://www.amiright.com/parody/60s/franksinatra73.shtml

tommy • June 22, 2011 2:07 AM

@ Nick P.:

Wow, your comments are more complex and informative than some published .pdfs, and that is a compliment, not a complaint!

I got sidetracked with Volleystore, and skimmed that paper. Scary to think of people free-riding off of ICMP echo requests. I wonder if my favorite ping target for testing purposes, http://www.example.com, has received an increase of traffic from those attempting parasitic storage? Just when we think we have enough hurdles to overcome, someone comes up with a new one (sigh)… although their own solution was both simple and elegant: a simple change to the ICMP protocol that doesn’t prevent the attack per se, but removes its benefit, by requiring the parasite to store one block of data locally for every block stored parasitically. This approach might be useful in other areas: don’t prevent the attack, but require the attacker to use resources GEQ the benefit; i, e., make the attacker’s ROI = 0 or negative. Wouldn’t work where the gain is hundreds of thousands or millions of dollars, probably, but in some other areas, it’s a clever approach that should be explored.

Pardon me while I have fun with words: “No gain, no pain”. (No gain to the attacker = no pain to the defender.)

I also see that I have a huge discussion awaiting on the single-bank Live CD or VPN ideas, but would rather answer this, as it took me a long time to respond in the first place (to Poly2 paper).

“For one, users don’t usually care whats in the box they turn on and surf with.”

Nope. So long as the user interface is familiar, comfortable, and convenient, most couldn’t care less, or even care to know, how it’s done. So, have a free hand.

However, my first impression is that your excellent ideas would be difficult, if not impossible, to implement in laptops, where bulk and ventilation/cooling become more critical issues. No OEM laptop would accept the types of things you’re proposing; when I asked my OEM about maybe upgrading to a faster CPU, they said that each mobo was custom-fit for a particular model of CPU, so couldn’t change the processor without chaning all the rest = buy a new machine. So instead, I bought a $40 1GB RAM stick for the second slot, which allowed me to disable swapping/paging to disk and get rid of pagefile.sys., esp. with useless services disabled. I read that for a CPU to read stuff that’s been swapped to disk takes 40,000 times as long as to read stuff directly from RAM. I believe it. MFT lookup, head seek, etc,…. This cheap baby is as fast as a lot of more expensive machines.

Just out of curiosity, could your proposed hw be fit into a standard laptop-sized container, even if it had to be custom-built? Else, I’m afraid that many who need laptops for travel (try composing your next paper on a smart phone on board the plane, etc.) couldn’t use the embedded-boards approach, though the idea sounds great for desktops.

“we just get some 1U or 2U PCI backplanes with 12 ports each and plug in 12 cards each, dividing functionality among them….. Each would connect to a inline device that prevented unauthorized DMA access attempts. Devices could only communicate through a high assurance, message router card that enforced the security policy…”

Isn’t this along the same lines of some of Poly2, with your divided-functionality cards whose access is restricted, being sort of analogous to their single-app machines, on a three-tier network, with strict separation of access and privilege? Different (and simpler-sounding) approach that could fit in a single machine, vs. the Poly architecture requiring a complete enterprise system design. What I’m saying is, I like it. You and they have the same ideas of separation and isolation, but you’re doing it in a single machine — which, of course, could also be part of an enterprise LAN that uses the other principles to control access and communication among workstations on the network, as well as a single home machine.

“For a home system, it might have a few boards in it. …. at least one x86 board that can run Windows and regular apps.”. … Runing Windows and regular apps a major win for Average Home User. (AHU) — I’d say, practially a requirement.

“They would access the UI of the master node with a button on the computer or a special key combination.”

We may be getting beyond the means or desire of AHUs here. Better to have a standard Windows-type GUI with a conspicuous desktop and Start menu shortcut; “Secure Mode. Click here before doing online banking or other high-security browsing.” Then if the GUI changes, they’re not shocked.

“So, the system is about four or five mass produced boards on top of the normal PC components. What you think? Could this work if marketed as a secure application platform? Be low cost?”

I think the second question would answer the first. I’m not up on the cost of each component, but if mass-produced — if Dell and other mass-marketers would tool up thousands and thousands of these, and advertise “New! Advanced security never before possible in your home computer!” — if the mass-production made the cost delta relatively small, consumers would buy it. If enough did, then those OEMs who don’t have it are at a disadvantage; their marketing d**wads would whine, and it would soon become an industry standard. *Someone will always undercut price by omitting that, but with enough media coverage, Homeland Security press conferences…

Look how long it took for firewalls to come standard OOB in Windows home systems. Not until 2001 when XP was introduced, and then, it was off by default. Useless, because AHUs didn’t know to turn it on. Finally, in XP SP 2 in 2004, it was turned on by default — what, 13 years after Win 3,1 became popular? Constant ads from 3rd-pary fw makers forced MS to act. Get even one high-priced OEM to use this, and trumpet to the world the secuirty of their system, and the others will have to follow suit sooner or later — which brings the price down yet more.

“I keep moving my data to external storage. If anything happens on this machine, I just pop in a LiveCD, retrieve any remaining critical files, format the HD, install fresh, update everything, and reconfigure everything. The entire process is usually done way faster than an Acronis restore, so I stopped using that.”

Good plan for most users. My entire HD footprint is about 835 MB at the moment (including 225 MB of Acronis, LOL), so an Acronis restore is just a few minutes vs. those with 400 GB of HD usage. … Actually, cutting the size of Acronis backups so that they would fit on a single DVD, then on fewer CD’s, is what started me on the minimalization path in the first place, though I’d already started conserving RAM by disabling services. The security implications quickly became apparent, and gave added motivation. Can now do one full backup and several incremental backups on a single 700-MB CD, plus raw (non-compressed, Windows-format) data backups. Full = 340 MB; increments, 15-80 MB depending on how long and how many major changes.

I too move data off the machine, or back it up off-disk, frequently, for the reasons you said: No fears.

“This strategy means, if problems are suspected, I’m one restore and data transfer away from a clean system. I like my current Linux approach better, though. ;)” … I like them both, plus, you have an added layer of redundancy, Can’t have too much of that… With my small HD footprint, haven’t bothered with the Linux idea, but for most people, your dual-boot setup, backup, and catastrophe plans would be excellent.

“The only chat client is AES-256 secured”

“Which one? An OTR-based solution?”

Um, no, I just use LogMeIn Hamachi free home version, as I’m not concerned with deniability or possible record-keeping or logging. The two uses have been: 1) To remotely administer the computer of an elderly relative, using other third-party remote admin tools, but runing them over Hamachi for additional security and intrusion-prevention, vs. running them over the Internet, and 2) Casual chat with remote friends, none of which is very sensitive, but without worrying about the virus-and-worm-infested networks that are AIM, Yahoo, etc., and with no third parties, incliding spammers, allowed. I don’t possess any national secrets or anything, which is fine with me. PGP e-mail is used for discussing privacy- or security-sensitive issues.

“Now, you may wonder why I praise Poly2’s minimizations, then promote building apps on top of high assurance platforms with extra, unneeded functionality.“

Your explanation made perfect sense. If I were trying to obtain certification for my trimmed OS (it’s nowhere near that, but let’s pretend), then as you say, every time I found a new file that could be deleted, it would all have to be re-certified. We have different goals (third-party cert vs. personal comfort level), and hence, different incentives. Therefore, different methodologies. The tense wasn’t always clear: Are these just ideas, or have you actually designed, and built, any? I hope you’ve attracted support for your approaches, perhaps sufficient at least to help design and build a prototype. Are you allowed to say whether you’ve implemented any such systems, and where? If not by name, then generically: Corporate, government?

“You’ve actually bested CERIAS…” … Wow, I beat Purdue University? I had no idea… but the credit isn’t all mine, as you’ll see.

“You really need to write a guide or a book on how you did that, what depended on what, what was totally useless, etc. “ ….My main source was a guy who must have spent thousands of hours of research, trial-and-error, etc.,

http://www.graphixanstuff.com/Forum/index.php?showforum=68

I needed a good bit of trial-and-error myself, since his setup, needs, apps, and usage are different from mine, as are everyone’s. But I doubt I’d have blazed the path myself if someone hadn’t already chopped down some of the trees. AFAIK, he has no plans to do the same for Vista or 7, probably because after spending so much time de-bloating XP, he’s happy with his setup and has no plans to buy and install another bloated whale. Nor do I. … I don’t think he’s into Mac or Ubuntu, but if someone who was, would just read his Guide and follow the same general path, they could probably do so. Are they as bloated as Windows?

I spent about two years gradually implementing his ideas, testing each significant change for a week or two, marking the failures, adding a few new finds of my own. I’d be happy to share them, but we run into the dfferent usage/apps thing. Everyone who follows his guide needs to check it against their own hw, drivers, apps, usage, etc. If you’d like pics of the properties and contents of the Windows folder and system32 folder (the biggest target), I’d be happy to email them to you.

Thank you for the kind words. Unfortunately, flaws will still be found endlessly in the files that remain, so please keep on striving for higher and higher levels of assurance in your OS and hw setups, while also trying to make it more and more affordable.

I just gave Bruce my two cents’ worth on his book cover and title, so I’m afraid the bank-security thread is going to get pushed back a day or two, then looking forward to studying the QMail paper and commenting, even if it’s this weekend. Of course, if you have any comments on this topic, look forward to them. Cheers.

tommy • June 22, 2011 9:50 PM

@ Nick P.:

“Actually, it just dawned on me that a new product essentially does laptop + embedded board. …. I wouldn’t use it, but it demonstrates the principle: you can include an extra secure board in a decent sized laptop. Only question: where to put the trusted interface… (sighs)”

So, if our discussion has you thinking of ways to fit this into laptops, then it’s synergistic and worthwhile. The economies of scale would increase tremendously if you could add the laptop market to the desktop market, even though many components would be different. The concepts are similar, which greatly reduces R&D cost, even if the components are different. It’s easier to develop the two in parallel than to do the desktop, then have someone ask, “Hey, can you do that for a laptop”, right?

“I can’t really say much about what I’ve implemented. It’s mostly a hobby for me, but those that want my grade of security usually demand secrecy too.”.

No problemo. I have one friend who’s done work for Gov contractors, including for NASA, but that fact is not exactly top-secret. I have another who’s doing some really advanced project for the Gov. I’d pull the old joke, “I’d tell you, but then I’d have to kill you”, except that if he told me any of the details, he’d have to kill me… Which suits me fine: “That which I do not know, cannot be beaten out of me.” (or drugged, extorted, etc.) I like remaining as low-value a target as possible.

“I’ve seen some of my own designs turn up in Ph.D. theses, research demos, etc. This can only mean a few things: they copied without giving credit; they independently arrived at the same thing; some of my suggestions inspired their final product.”

Which is what makes proving plagiarism so difficult. Sometimes, a long block of text or a complex diagram is *identical”, which is a good give-away. Stealing ideas without credit (and a share of the profits, if any), is scum in my book. Inspiring others is quite a compliment, which should be returned with an acknowledgment: “Inspired by concepts first presented by Nick P. [9], for whose semiinal work we are grateful.” … So, if your high-assurance laptop hits the market, I get credit, right? (KIDDING!! 😉

Example: The Chiffons and their producer successfully sued former Beatle George Harrison, because the latter’s song, “My Sweet Lord”, used the same melodic structure as the decade-earlier hit, “He’s So Fine”.
Musical experts testified about the unlikelihood of the same “string” reappearing over and over.

http://en.wikipedia.org/wiki/He%27s_So_Fine#My_Sweet_Lord
http://en.wikipedia.org/wiki/My_Sweet_Lord#Legal_controversy

“So, was it “great minds think alike” or “good artists create, great artists steal”? Not sure.”

“If I have seen further it is by standing on the shoulders of giants.” – Sir Isaac Newton. Be honored to be one ot the giants on whose shoulders they stood.

“It’s mostly a hobby for me,… I’ve certainly designed 100x more than I’ve implemented. … But most of my work is for society’s benefit, not profit, so I’m fine with it either way.”

It’s good that you enjoy your hobby enough to do it without thought of compensation, much like my silly little hobby. Except that yours actually improves the world. 😉 … Seriously, if you like playing with ideas, then keep putting them out there. Regardless of whether the people who sign the checks want to go for it, you have the satisfaction of knowing that you’ve shown the world what could be done. Whether they do it is (usually) out of your control, but the Wright Brothers’ first flight wasn’t of any immediate practical use, either. But by showing the world that it could be done, it inspired them and many others, to where we now take jumbo-jets for granted. Someday, perhaps we’ll take for granted rock-hard, bullet-proof smart phones, because you tried to do HA in a laptop, then someone started from your ideas and tried to do it in a smaller box, then someone else took that idea and …

“It’s unfortunate that he’s done because Windows 7 is the ideal OS to do this too. It’s the best Windows design they’ve come up with….I’ve confirmed it also uses about the same resources, in default config, as an XP system does.”

Famous for being the only OS in MS history to use fewer resources than its predecessor, and that goes all the way back to DOS systems, IIRC. Perhaps the EU lawsuit over misrepresenting how many existing machines could use the resource-hogging Vista had something to do with that? Which was satirized rather viciously in the following:

http://www.amiright.com/parody/60s/julieandrews131.shtml

which was received very well by a not-necessarily-tech crowd.

I don’t feel inclined to spend the money to buy 7, nor to learn the intricacies and do the trial-and-error deletion, but since you’re already on it, and like to play with stuff, maybe set up one copy on a separate partition or external HDD that isn’t the default-boot, or on a spare machine; follow the same general paths; logging every change; note what works and what doesn’t; with frequent Acronis backups of that partition or external drive only, so you can reverse any fatal errors?

Scroogling (I trust Brandt more than Google) “Windows 7”+trimming gives some interesting hits, like

http://www.sevenforums.com/performance-maintenance/4855-guide-trimming-w7-down-much-possible.html

which gets the install down to 2.5 GB. Others at the thread confirmed what you said, that it’s about equal to XP Pro in resource use, but one wanted to put it on various portable devices, and another, on an older computer with less RAM and HD space.

Haven’t looked at them all, but you might find something interesting among them. At least, it shows that people are working on the idea — probably inspired by the pioneering work of the guy who did the XP trimming guide. If you have major success, I’ll bet hosting a similar site or forum, or even publishing a .pdf or e-book, would be successful.

“The only drawback is in the DRM stuff if someone finds that an obstacle to their work.”

My 2005 XP didn’t have most of that crap, and I refused it (another benefit of parsing Patch Tuesday updates very carefully, including refusing IE 7, 8, and 9). The 2008 has some; I haven’t tried deleting or disabling it, partly because I want one machine in relatively OOB condition (just got rid of some huge, ulltra-low-hanging fruit that wouldn’t affect functionality), and partly because I don’t d/l DRM-type stuff. Hey, any video at YouTube, I can turn into an MP3 or movie… (won’t say how, though I’m sure it’s an “open secret”.)

Take a look at the W7 trimming search results and see what you think. But I’d rather have a high-assurance system than the smallest possible one, even though I’m using the Poly2 small-is-better approach on my own — no other options without custom-building a laptop. (I’m a laptop fan — no pun intended – for various reasons.) When you build your HA laptop, I’ll be happy to test it. 🙂

tommy • June 23, 2011 9:06 PM

@ Nick P.:

“>> except that if he told me any of the details, he’d have to kill me…”

“I often joke like that too, but it actually is kind of a joke. If he told you classified information, HE would be guilty of a felony and, depending on his intent & potential damage, possibly prosecuted for espionage…. ”

Which is exactly why he’d have to kill me: So no one could ever find out from me, voluntarily or otherwise, that he’d divulged it, assuming he divulged it to me securely in the first place. … So there is a nugget of truth in the old joke. 😉

“I can honestly say you’re feedback might have reduced the costs. … you forced me to enumerate possible areas of overlap in similar product categories and I noticed that there’s more than I first realized.”

Found the right word for why Schneier blog discussions are the best around: “Cross-pollination.’

“I was thinking though if you want the easiest route to a minimalist system you might want to…”

Thanks – but it’s minimal enough for me now, and the work is already done. 🙂 … and all compatible with apps for Windows. Had I not already done all this… but you’ve given some good ideas to anyone else who despises bloat.

“Stress is the silent killer. Happiness is one of the necessities in life… ”

Or as someone once put it, “Laughter is the best medicine.”

Also, some subset of that hobby is social and political satire, which has been recognized as a strong means of criticism since ancient Greece and Rome. People often tend to absorb more, or get the point better, when it’s delivered in an interesting and amusing way. I could flood you with examples, but will just give a few samples (your beliefs may vary):

Recently, Reps. Ron Paul and Barney Frank introduced legislation to get the Feds out of the weed-busting business, which has been a costly failure anyway. (Not a partaker myself, but I don’t think that gives me the right to tell you that you can’t.) I hit that topic hard (twice in one day) two years ago when Michael Phelps proved that you can set a record for most gold medals in a single Olympics, even while taking a toke once in a while.

“Killing Me Softly With His Song” by Roberta Flack =
“Swimmer Wins Oftly, Hitting Bong (Michael Phelps)”
http://www.amiright.com/parody/70s/robertaflack17.shtml

“Big Spender” by Peggy Lee =
“Hey, Bong Swimmer (Michael Phelps)”
http://www.amiright.com/parody/60s/peggylee1.shtml

The other side of the BP oil-spill story; Corruption at the oversight agency, and the Administration’s failure to address it:

“Show Me” from “My Fair Lady” =
“Show Us (POTUS v. Minerals Management Service and BP)”
http://www.amiright.com/parody/60s/myfairladylernerloewe18.shtml

Lots more there: Senator Larry Craig, O. J. Simpson, Michael Vick, the current POTUS and the previous two; the current V-POTUS and the previous one; etc. Plus one about an issue that Bruce blogged:

“A high school bans backpacks as a security measure. This also includes purses, which inconveniences girls who need to carry menstrual supplies. So now, girls who are carrying purses get asked by police: “Are you on your period?”

http://www.schneier.com/blog/archives/2007/10/blowback_from_b.html

I had sent Bruce the story, but of course others might have as well, and he may have seen it himself first. The piercing parody of the stupidity described there, and of outlandish terror fears in general (using the media’s definition of “terror*):

“Put Your Head On My Shoulder” by Paul Anka =
“Is Your Purse A Gun Holder (Or On Your Period?)”
http://www.amiright.com/parody/misc/paulanka6.shtml

Last one, I promise, and probably the granddaddy of them all: a non-partisan rant about Government and politicians in general, done to all four verses of The Star-Spangled Banner:
http://www.amiright.com/parody/misc/francisscottkey21.shtml

“I have never made but one prayer to God, a very short one: “O Lord make my enemies ridiculous.” And God granted it.” — Voltaire.

So they may serve some purpose in ridiculing the pompous and idiotic.
No obligation, of course, end no offense taken if skipped. Plus the usual guarantee: Double your money back if not satisfied. 🙂

Hope I don’t have so many links that it trips the filter, but the trust model based on using the same e-mail address in that field has worked so far – haven’t been auto-filtered since. One more little-publicized aspect of the BP thing in the signature link. Fingers crossed…

tommy • June 30, 2011 2:23 AM

@ Nick P.:

No apologies necessary –“Life Happens”. … and the parodies were hardly obligatory reading. 🙂

Yes, the media didn’t showcase the corrupt officials nearly as hard as they hit the Big, Evil Corporation, as your own experience shows — especially a foreign BEC. If it had been Exxon/Mobil instead of British Petroleum, would the reactions have been different? … Still, corps are a fave scapegoat, partly because broadcast media don’t get their licenses renewed by BP, but by the FCC, which is a, um, “Government” agency. 😛

I don’t excuse BP. But comparing a crook to a crooked cop who accepts a bribe to let the crook go, I regard the cop as the more evil of the two, because he was specifically entrusted with preventing or catching the crooks.

“The Star Spangled Banner parody was my favorite. You 100% nailed that one. I wish there was an audio performance of it.”

Do you remember the line from the original “Rocky”?

“Why did you become a boxer?”

“Because I can’t sing or dance”. lol

I write, but I can’t sing or dance either. If you, or anyone you know, wants to record it, add some appropriate video, and upload it to YouTube or whatever with lyrics credit, cool . A fellow writer put one of my Vista-trashing parodies on YouTube, but with karaoke lyrics only, no actual singing voice. That doesn’t get so many hits – needs a voice. It’s

http://www.youtube.com/watch?v=PMKg1yR8egQ

I sold a half-dozen or so parodies to a radio producer, who syndicates stuff to about 700 indie stations nationwide. The best was on Sen. Larry Craig. He said his singer had a hard time getting all the way through a take without cracking up laughing, which is about the best compliment a comedy writer could ask for.

Others were Astro-Nut Lisa Nowak; H. Clinton during the VP speculation in 2008 (they cut it in half due to time constraints — gotta get in all the commercials); McCain’s choice of Palin; Scooter Libby; and John Edwards, back when his biggest problem was his campaign paying for his $400 haircuts. They each dropped off the air as the news became old, but the Edwards one kept getting new lives as his further problems continued to become public.

Won’t burden you with any more links to the lyrics, except upon request. I do have mp3s of the productions, but not for mass distribution. The producer bought the complete North American airplay rights, and guarantees exclusivity to his subscribing stations. However, for someone who clearly understands the need for NDAs and respects them, I think I could entrust a copy, with the agreement that it goes no further. Could e-mail them — disposable e-mail address is fine. Any of my own song pages of the past two years or so has the email-revealing reCaptcha right after the copyright notice – your fave “Star-Spangled” has it.

As you said, stress is the killer. In addition to the usual stresses of life, I’ve been impacted pretty hard by the ongoing economic mess, so these are pleasant diversions.

Back on topic:

I myself have been slammed for a week or so, and only just now returned to the Electronic Banking thread (other than my post about the bank’s stupid “Security Stamp” for e-mail), where I saw the patent discussion and left comments to all, including to your very fine and thorough summary of the Live CD.

Not quite up to reading a Clive post ATM, especially if it’s so much longer than his average as to deserve “essay” status. 😉 But will do so. And your QMail .pdf is still on my desktop, so that it will keep reminding me to read it when I can do it justice, as I’m quite eager to do. Thanks as always for your responses.