Slashdot Mirror

Burial wasn't sufficient for Windows ME; it had to be nuked from orbit.

What do you think the best way is to lock down a system against malicious insiders?

Ripley: I say we take off and nuke the entire site from orbit. It's the only way to be sure.

http://nukeitfromorbit.com/

...it's the only way to be sure.

It's the only way to be sure.

We have the source, it is possible to make a Linux distribution that lets a normal user defend themselves.

The first look would probably be something like Puppy Linux. This boots off of secure storage (a CDR) to which it adds another session just before you power off. This very simple technique gives the user the ability to throw away a session by just turning off the machine. Puppy also keeps the sessions independent on the disk so you can go back to a known good session but still collect user data from later sessions.

Think carefully, the problem isn't that the administrator is "unqualified" the only qualification they need is the ability to notice that something is wrong. A that point Puppy linux would allow them to go back or start with a clean CDR. It's still a bit of a pain to recover later changes from the old setup though.

That's the key. It's called the factory reset button, it puts the machine back to the state it was when you bought it. Complete with all the extras you bought for it. It leaves the machine ready to continue working with your stuff. Don't miss that bit; it must only delete code that's made itself part of the OS not your passive documents.

That's actually it; the core is that simple, you need to have a trusted boot and protect that boot from any 'untrusted' code that runs later and give the user the ability to stop that untrusted code from running. This trusted 'zone' also has one other job; protect the user data, make sure it cannot be damaged by anything once saved. That bit's called a versioning filesystem.

Microsoft are trying to do this, but they are severely hampered by years of crap code, bad installation management tools and horrible APIs. Linux OTOH has the Unix history of solid multiuser protection, it's got a lot less further to go.

Ho-ho-hold on, hold on one second.

http://nukeitfromorbit.com/

Only one way to block BitTorrent.

There, fixed that for you.

Obligatory link

The internet agrees.

It's the only way to be sure.

"take off and nuke the entire site from orbit. It's the only way to be sure"