neomantra
11 hours ago
I really appreciate that this supply breach was discovered by a diligent system operator (tracking a slow HTTP request).
Similarly, the xz breach was uncovered by a diligent developer looking at quirky SSH login performance regressions.
mlyle
8 hours ago
Malware used to be pretty obvious for performance penalties.
But we are getting so much faster, and networks are doing so much weird inscrutable stuff now that it’s a lot harder at baseline. And, of course, the baddies are getting sneakier, too, and we are building systems from more components from more diverse sources.
I worry about the long term picture a lot; does all of infrastructure become a little untrustworthy at baseline?
bee_rider
7 hours ago
Wasn’t that supposed to be the default assumption? The bad guys start just after your network interface.
This was the argument against WiFi encryption in the old days (who cares about WiFi encryption, the network is assumed evil, so your messages should be encrypted rendering WiFi security moot). Which actually seemed pretty compelling to me. Nowadays, of course, someone will hop on your WiFi and download a bunch of movies without authorization, giving you copyright headaches. But that’s authentication…
alexchantavy
6 hours ago
Yeah that's what's called an assume breach/zero trust mindset. In a modern environment you can't rely on the network perimeter being a security boundary, so you need to minimize permissions (so that if an identity is hacked then the blast radius is reduced) and invest in detections and remediation plans.
mlyle
6 hours ago
Sure— but now everything has so many dependencies; dependencies are recursive, and the scope exceeds any reasonable audit. And at least getting lucky enough to spot malfeasance is getting less and less likely as performance and noise grows.
SV_BubbleTime
8 hours ago
> I worry about the long term picture a lot; does all of infrastructure become a little untrustworthy at baseline?
Isn’t that a scenario that is better?
If you stop trusting potentially insecure systems you start developing hard and solid ones.
I don’t worry about deepfakes or AI malware, I welcome it. It’s stupid that we have insecure systems like unencrypted emails, social security cards, unsigned documents, passwords in PIN codes alone, etc.
mlyle
6 hours ago
I think what I am describing is worse. I have a harder and harder time as software and the resultant supply chain surface grows. And my chance to filter, monitor, validate, and audit software gets correspondingly worse as systems do more and more.
More components; recursive dependencies; more remote infrastructure; these are the directions the world is going, and the stuff we need to manage this complexity is not keeping up.
marcosdumay
6 hours ago
Hum... If you try to fight the stuff on your first paragraph with more of anything, you'll lose every single time.
You can only fight it with fewer components, fewer recursive dependencies, and less remote infrastructure.