Slashdot Mirror
A Closed Off System?
AnarkiNet wonders: "In an age of malware which installs itself via browsers, rootkits installing themselves from audio cds, and loads of other shady things happening on your computer, would a 'Closed OS' be successful? The idea is an operating system (open or closed source), which allows no third party software to be installed, ever. Yes, not even your own coded programs would run unless they existed in the OS-maker-managed database of programs that could be installed. Some people might be aghast at this idea but I feel that it could be highly useful for example in the corporate setting where there would be no need for a secretary to have anything on his/her computer other than the programs available from the OS-maker. For now, let's not worry if people can 'get around' the system. If each program that made up the collection of allowed programs was 'up to scratch' and had 'everything you need', would you really have an issue with being unable to install a different program that did the same thing?"
Doesn't a live OS CD such as Knoppix achieve this goal? These are usually built for "everything you need" for a particular purpose. You can still access and create data on disks on that system, but you never corrupt the programs themselves. If all the applications being used are web based, then things are even simpler - simply boot up with Knoppix, open Firefox and you are ready to go.
Amanda: Open Source Backup Software
fun you must be to think up questions like that.
This sounds suspicously like a LiveCD or DVD of some sort of *nix variant - OpenBSD sounds good.
Death by snoo-snoo!
Just face it, with the internet as it stands today, no matter what you do, there will always be cases of viruses, malware, spyware, adware, etc etc. The only way to really not be affected by this is to NOT use the Internet which in the corporate world is basically a no no. Maybe have a couple of machines that use the Internet when needed and the rest on the server are dead to the net.
You can install software on the livecd. It only exists tell the ram is wiped (restarted) but is runs just fine.
Oh really?
Windows has long been able to do this via Group Policy. You can specify that only programs signed with specified Authenticode keys can be run, effectively locking the system. Since all OS files are signed by Microsoft and anything a corporation would need could be signed, then if a corporation wanted a locked-down box, then they'd just specify the allowed keys and block everything else.
It'd be a huge nuisance but it's possible today.
For office use, a linux distro (such as Debian or Ubuntu) which allowed you to specify the repositories, and not allow modification of the list, would work just fine, in general.
...
System admin's would only allow updates from the offical repository, with a local repository for mirror/caching and business specific software packages.
I use something like this for my relatives. Give them a linux, don't give them root, make all updates/installations go through me.
Then print out a poster for my door "setup.exe will not run on your system"
Think about this: If that database included the infamous Sony rootkit as "allowed" due to them laying pressure on whoever maintains it, doesn't it render the whole thing pointless?
This would be "mostly secure", but unless strict data-space separation would use it might still be vulnerable to a buffer overflow or similar attack that would allow arbitrary code provided as data to be executed. The attacker would use this opportunity to establish a "beachhead", modifying whatever integrity-checking system the OS is using to allow it to continue to exist.
"If each program that made up the collection of allowed programs was 'up to scratch' and had 'everything you need',"
Considering that is impossible, the question is pretty much moot, isn't it. I am always going to find more needs for things, and chances are I'm going to need a new piece of software. Even if an OS shipped with "everything", new things are invented all the time. Maintaining a "Closed OS" to allow for new things would be difficult, and to keep it relatively up to date even more so... but then it wouldn't really be closed if new stuff kept getting added to it...
If the group responsible kept up to date by adding "certified" software to keep up with the "joe average" software needs, this could work.
As someone experienced who regularly uses Linux and Winderz (only with FFox and otherwise properly locked down), I wouldn't use it -- but I would likely switch the parents and other non-savvy friends and family to it quickly.
Interesting idea.
This is exactly what Microsoft would like to do with Treacherous Computing, although the issue would cover things like security from the user rather than for the user.
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
Yeah, turns out somebody was doing this for kind of a while. Called them "typewriters" or somesuch.
Really, much of the value of a computer lies in the fact that it's an extremely versatile device. Choosing to discard all that, and believe that you can know ahead of time every single thing you will ever want to accomplish with it, seems like a pretty bad deal.
already does this. See here, under "Application Access: You Decide". You can set up another user account for yourself (not just any children) which would be protected. I'm pretty sure Windows has similar things (not sure if you need 3rd party software to do this) and as mentioned, there are live CDs of Linux/BSD/etc.
As far as I'm concerned, Ubuntu and the other Linux'es are already this. I never figured out how to install *anything* on the damn things. If it wasn't in the catalog, then you had to be a full-time dork to get it working.
All in all, the experience wasn't bad. There were some good programs in the list. However, maybe just because I've been around PC's for so long, there are certain programs that I wanted to use, and was frustrated that they never worked. I don't know if this would bother regular people.
The only problem with this is sometimes (often), the catalog titles didn't even work right, then you're stuck with no alternative, and a new, expensive doorstop.
Suffice to say, I now use Windows.
Isn't this the same exact thinking behind the TCPA planned by Microsoft & Co? Where only "licensed" software would be allowed to run? Doesn't sound like a bright idea to me, in fact it sound pretty scary.
No. LiveCDs do offer read-only system images. But they do nothing whatsoever to prevent other programs from being run. I.e. programs downloaded from the net, autorun(or manually) from cd. LiveCDs get you the benefit that each reboot resets you to an known state. That is quite different from an OS which only allows programs from a blessed whitelist to execute. One scenario might be the discovery of way to remotely log into the system. In the livecd case, the attacker can now run whatever program they want, and likely regain entry in an identical fashion should the system be rebooted. What the author of this post is interested in, is a system what would not let the attacker with remote login be able to execute any code not on the blessed whitelist. Now mind you, the idea that such a system would be 'invulnerable' is ludicrous. The XBox seems the quintessential example of a system which tried to achieve this design goal. My XBox currently runs ssh, freevo, and any executable I want, proving it is difficult to achieve a successful implementation of such a design. -jdog
Huh. Imagine that... Something which can be done by having a Microsoft OS set to run only signed binaries while running on top of a 'trusted computing platform'.
As I've said before, this would be a huge boon to IT departments all over the place. I'd love to be able to lock users to running a signed OS only the apps we specifically approve and sign. This would lock out all unapproved software *and* malware. If the OS is secure enough to keep there from being any ways around this, it'll be ideal.
Oh, and of course, as long as such trusted computing stuffs can be turned off for users who purchase the hardware and don't wish to use it, it's a win-win all around.
If you're going to consider limiting users that much, why not simply disable web access or cd players, usb ports etc? I think ultimately, there are several ways to keep a machine safe from intrusion, but it's a compromise for most of us ... functionality vs security. If you want to tilt towards security, in-house systems, disabling activex controls, java, admin access etc are all effective to a certain degree, but much like your concept, sound extremely limiting. I mean, secretaries don't need any software other than pre-installed stuff? Right, what happens when said secretary needs to open an emailed document that requires a reader? It osunds extremely inflexible at a time when flexibility can be very important to businesses. If you wanted to be secure, you could also go back to paper & pencil, registered mail, and pay your bills by armed stagecoach.
Anyone else think this sounds a lot like the xbox 360? encryption keys and all.
The war with islam is a war on the beast
The war on terror is a war for peace
Just about every office I've worked at so far has a certain number of menial computer jobs that are unique to the job setting. And many of these menial jobs have been passed off to the secretary. And many times I've been asked to come up with a little push-button application, macro, script, batch file, or something, just to make the job easier.
And as a software developer, there's just no way a completely closed system is going to work for me....
Good judgment comes from experience.
Experience comes from bad judgment.
Lets see the Commodore PET, Apple II and TRS-80 were pretty \much can't touch this OS without a hammer type computers.
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
I don't quite get the point... If all apps have to be signed before install, then you have a point of attack. Intercept communications, fake checksums, attack the OS providers server, ... wouldn't be much more secure than anything else.
Wouldn't it make more sense to go back to the live cd concept... You pick everything you need and then make a bootable cd out of that. We did that 10 years ago - was a lot of work but worked great. I'm sure over the years people have written better scripts than the hacks we did back then - but basically you would make a chroot filesystem, put all your apps and do all your testing until stuff worked. Then we created a boot floppy and out of that and the content of the chrooted filesystem, we made a bootable cd. That went into the production server (a high profile site back then that drew tons of attacks) and if the box got hacked, they still couldn't do anything with it.
That way you have 100% security from the point you were looking at - while still maintaining the ability to add/remove/modify things yourself as you need them...
Peter.
You mean like a Mac?
This sig intentionally left blank.
Check out the LTSP system.l
With all the applications based on the server, and no program load allowed it can be just that.
It is very popular with schools.
http://desktoplinux.com/articles/AT3124052951.htm
Sane corporate environments don't allow users to install anything anyway. Non-root user accounts exist for a reason. Most OSes allow you to prevent executables from running from user-writable areas (e.g. in linux, mount /home noexec (see man mount)).
Your database would have to be tied to specific versions of the software to prevent new features breaking your previously cerified model. Of course, this database would prevent you from installing security fixes until the security fix was approved by the DB maintainer. You would have to ensure that the applicaitons that you trusted came from a specific source and matched the configuration that was tested, and if you've done that, you might as well supply a package format that can verify the contents and identity of the file to the database. It'd be nice if you could also provide license and dependency information, etc. Congratulations, you've just invented RPM, or APT, etc.
....limit a machine to only outgoing traffic? That would let you use an office suite and send (but not receive) email.
Downside: you'd have to use a CD or flash drive to transfer documents on/off the machine. You couldn't receive email on the machine.
Upside: The only security risk would be by direct access.
Actually, the most secure machines probably aren't even password-protected. If the machine isn't attached to anything but a power cord, and the machine itself is inaccessible, then you've got a secure machine. If you're running Win3.1 or something, it might DIE, but it would be a secure death.
...I would have to say no. At least not by itself. It's pretty hard to develop software if you can't install and test the software you're developing somewhere! ;)
As a component of a larger, networked system, which had parts where I could install and run the software I was developing, then yes, no problem. But alone, by itself, no, it would be completely useless.
Of course, there's still some interesting questions about this theoretical beast. Is it scriptable? I often have quick one-off tasks that are best done with a quick script. If I can't run one-off scripts, then it's not "up-to-scratch" and doesn't have "everything I need", and if it can, then it's not a completely closed, locked-down system. The only way around that, even in theory, is to have an infinite number of monkeys providing you with all the scripts you could ever need in advance, and even then, there's probably be some difficulty finding the script you need right now from that infinite number of scripts. (Not to mention the costs of the infinibyte drives needed to store all those scripts.)
Bottom line, I think the notion of a machine that does "everything I need" is about as realistic as those old concepts of an irresistable force or an immovable object. Nice for creating logical paradoxes, but completely silly otherwise.
Its a good idea, only it already exists. Kinda.
Take any Windows Linux or OSX system, and lock it down till its just a kiosk.
There you go!
This is also doable with a windows98 installation onto a CD. Knoppix comes to mind for Linux. I've also tried setting up a kiosk like graphic OS to go onto a compactflash card that acts as an IDE device. I needed newer apps too many times on it.
See, a FIXED OS needs to be configured seperately for each system since noones requirement is the same as anothers'. QNX, Windows CE, PalmOS and ucLinux come to mind. But Windows 2000/XP etc will work too.
Did you mean an OS DESIGNED that way? The act of installation is managed by the libc and scripts to place it in the right folders. Take away the permissions and remove the scripts that do the installation (Windows Installer) and you're there. Theres nothing more to redesign in the libraries or kernel.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
You know, all the products in the supermarket are really distracting. What I crave, as a product of modern USian culture and educational systems, is less choice. Why should I have to decide what to do? Surely someone could pick all the useful things for me. Maybe there could be some kind of vote, where we could all just agree to use what everyone thought was best. That would be a perfect world, with no cutthroat competition or need to worry about the future. Shouldn't I be free from worry and uncertainty?
I want to delete my account but Slashdot doesn't allow it.
Windows fails both the "up-to-scratch" and the "everything you need" tests! But yes, I agree, it can be locked down, as can most other modern OSes (all of which also fail those two critical criteria--I'm not Windows-bashing here).
You would have the OS installed on a flash memory drive. Either its in the system ( embedded like ) or its a plugin card like sd stick. Read only though. You have memory that you can use as program running space. You can save data to external system like flash drive.
Lastly, you would run applications from a second flash drive.
Think of a linux on cd kind of system ( or other os 0 with no hard drive, and you save your data on a flash drive. All programs are on the cd. You can only read and save data to the flash drive, but not run programs from it. You'd have to remove the command prompt, and a few things from a linux distro to do it though.
Only 'flamers' flame!
Does slashdot hate my posts?
Unless your system is 100% proven for all inputs (of the input classes you are using), there is the possibility that an attacker can feed an input for which your program's state machine does not halt (and, instead, goes into other states, perhaps escalating privileges or otherwise doing anything).
So this means you either have completely disconnected systems, or you only use things like Spin which are provably correct.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
...it could be highly useful for example in the corporate setting...
Oh, for fuck's sake! Don't give them any more ideas.
The extra cost of technology staff and the risk of a shittastrophe are nothing compared to abysmal employee morale. If you don't let 'em stroke off for a few minutes a couple of times an hour by going to ebay or playing snood you're going to end up with a resentful staff. And they'll produce awful, crappy work for you.
I think it's fine (in some situations) some some central authority to be the one who decides what can be run on their computer.
What I don't get, is why the "OS-maker" would be that authority. Look at just who happens to be the OS-maker with the greatest marketshare, and ask yourself: should someone with that repuation for [in]security, be the one who is in charge? They practically invented the concept of having browsers that automatically install malware and media-insertion that installs rootkits.
Locking down computers? Maybe a good idea. OS-makers locking down computers? Sounds like putting the fox in charge of the henhouse.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Video game consoles have been doing this for a long time. What you describe is exactly what an Xbox is... a computer with an operating system that only allows the user to run signed code (unless the users "get around" it... to show how viable this idea is) while only allowing the user to save documents.
Speaking as a user who understands their computer reasonably well and doesn't click on stuff just because animated characters tell me to, would this be a good thing?
If we (hypothetically) closed off the "stupid user" vulnerabilities that are the major attack vectors right now, wouldn't the malware authors instead just concentrate on other, more technical, avenues of attack?
Here's my thought: maybe having systems vulnerable to idiot users is actually a good thing for the informational ecosystem as a whole. They're more than just the canaries in the coal mine (although they serve that function, too), they provide a steady stream of marks for the virus/trojan/malware writers and phishing-scheme authors of the world.
If these people weren't able to basically throw themselves on the swords of their own stupidity on a regular basis, couldn't this just lead to smarter malware, which affected more of us (not just the stupid/ignorant)?
Malware authors are inherently lazy and opportunistic. While there are still lots of "the monkey told me to click it so I did" people around, and ways to exploit this idiocy, that's what they're going to do. They're not going to mess around with esoteric buffer overflows to steal your information, when they can just send out some fake PayPal emails and watch the data roll in.
Given the choice, I'd rather have the primary attack vectors be ones that rely on user stupidity, rather than technical flaws, because 0-day technical flaws are too 'egalitarian,' attacking both the clueless user and the experienced person without warning. Personally, anything that keeps the collective attention of the Russian Mafia focused on people too dumb to check the URL line in IE before typing in their bank account information is a good thing in my book.
I know this isn't a very nice sentiment to hold, but if there was some hypothetical way to remove user stupidity as a vulnerability (not possible, so this is all just a mind game), maybe we'd be better off not implementing it?
I'm not suggesting that we shouldn't attempt to educate people on good computing practices, but if people are too lazy or disinterested to become educated, maybe in their laziness they can do the rest of us a favor by acting as the collective decoys?
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
It sounds like going overboard to solve the problem. Like designing a house to be hurricane proof when you are building in Oregon.
Linux has long had the ability to be installed on read only media. So your dream system already exists.
Even windows provides enough security to solve the problem. Running as a standard user I feel my windows computer is fairly safe from browsers, rootkits installing themselves from audio cds, and loads of other shady software.
It's a bit of a hassel sometimes. I moved from one timezone to another and can't change the time on my computer's clock. It's been about 8 months now and I still haven't bothered logging in as administrator to change the time.
Of course, it's not secure if anything running anywhere has the ability to modify the system files.
--Mike--
This model is predicated on, I think, a fairly simplistic conceptualization of software. It seems to assume that one can draw clean borders between pieces of software, ie., that a webbrowser, a wordprocessor, or an image editor is a discrete unitary entity. The reality is quite far from the truth of plug-ins, extensions, proprietary data formats, competing standards, and the inevitable need to communicate with an external world that is constantly changing.
Homepage
Obiter Ludens Game Blog
I have no problems with this setup if the computer is my Cell Phone. My PDA could be setup to only run signed apps, that wouldn't bother me much. But my PC isn't really a PC without the ability to accomplish arbitrary tasks.
.mp3 and .jpg buffer overrun bugs are great examples of this too. A format that doesn't even include programability can be used to induce your computer to do something against your will.
The concept is also flawed. Just because something isn't an executable doesn't make it not contain instructions that tell your computer to do something. Word macro viruses is a great example of this kind of problem. It's just a simple word processing document.. but it can also be a virus. The
This is not the answer to computer security.
set softtabstop=4 shiftwidth=4 expandtab nocp worlddomination
I dual boot Linux and Windows.
I use Windows on the rare occasions I need it but Windows is NEVER connected to the Internet. Linux is.
Problem solved.
Seriously, this has worked well for me for several years now.
You know, I think I have a computer made like this. It only runs software provided specifically for it and signed by the vendor's company. It's called an X-Box, and I use it to run linux. *Evil laughs*
Seriously though, think about it, that's essentially how the recent generations of game systems have gone. Specialized hardware with software built for one purpose, signed by the vendor so as nothing else can run. And as xbox-linux shows, there will always be ways to circumvent this without direct access to the hardware.
My advice would be steer clear of an actual livecd/dvd itself, due to the significantly reduced speed of such a system. In the case of linux, just go with a setup where the majority if not all of the filesystem is read-only to the user. Or beyond that even, have the main filesystem contain a loopback read-only filesystem. A great example would be Damn Small Linux, it can copy the disc image to the harddrive and it doesn't take a lot to set up a kernel to read from that on boot. And in that particular case, DSL is modular, so adding approved software doesn't take a lot of effort.
Another potential candidate would be something like dyne:II, similar to DSL in it's live and extensible nature, but it has a much larger software library to choose from by default.
Of course, users will always need to save their doccuments and such somewhere. Retaining the ability for a less-than-computer-literate user to perform basic tasks such as saving the vacation photos of their grandkids in an email attachment, while keeping the rest of the system closed off but still functional, can be quite difficult to do without accidentally leaving a door open which could let in something potentially malicious.
But then again, what is life without risk?
So, I'm not meaning to troll, but a likely implementation is some sort of signing of the code that would be allowed to run and someone would have to hold the private keys. Is this against the terms of GPL 3? Would this be effectively like a DRM technology? My understanding of GPL 3 is mainly based on the threads on linux-kernel where Linus explains why he thinks that GPL 3 would be bad for linux. It would be interesting to see if one could have a slightly more flexible system where I could allow sign the code I allow as a method of virus prevention. Usually Ask Slashdots are pretty OT but I find this one fascinating.
Do you understand the Secretary's job? I mean really understand it, the official and unofficial parts. Do you understand it enough better than she understands it so that you can build a computer that does all of the things she needs and wants it to do? And don't forget, it needs to do everything her boss decides she needs to do with it.
I'm not -that- smart and I'll bet that you aren't either.
There are places where a closed OS works. Think wireless router or Internet appliance. But the desktop? Not so much.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Symbian OS form v9.1 is very close to be "Closed OS" (pan intended). If application use any "capability"(for example camera API) - any but most basic functions, it should be signed - endorsed by "test house", which have license from Symbian itself. Third party applications still possible, but only from certified developers. So if Symbian v9.1 will be any success there will probably be more closed OS in future.
There's nothing special about application signing. Making your existing read-write partitions and any mount no-execute is the equivalent of saying all existing applications are signed and no others are and would solve this problem.
Application signing can be compromised just as much as the above. If done properly it does give an extra layer of protection.
You might say that one difference is that application signing can be done remotely so that the owner of the computer loses control but that's no different from the owner not having the root/administrator password.
Both can be compromised by physical access to the hardware though TCPA does try to make access to the key hardware hard.
Application encryption can block the owner from executing anything the encryptor has encrypted but that still requires the keys to be obtained from somewhere when the application runs, either the net or embedded hardware, and there is a potential hole if the owner can capture those keys.
---
Unregulated DRM = Total Customer Control = Ultimate Customer Lockin = Death of the free market.
... pay particular attention to noexec flag -- yes, one can configure his/her generic U**x system not to be able to execute anything off "other media" (including home directories) for what, like, 20 years... ;-)
Amazing what those guys back then thought of, is not it?
Paul B.
You are indirectly referring to the concept of executable management. The central idea here is to only allow trusted programs to run on the system. Under such a scheme the kernel would have a list of allowed programs (and libraries) complete with MD5 hashs etc. (to establish a chain of trust). When a program is executed the kernel would calculate it's MD5 sum (and sums for anything else that is loaded into memory) and the calculated sum isn't on the list then the program is not allowed to run. Under this scheme the users could "install" anything that they want on the system, but if it's not approved it doesn't run.
While a system like this would keep "bad" software from running on the system it is not a silver bullet (nothing ever will be), as someone will find ways around it. For example using an exploit in an allowed application that is already running.
There are also a couple of big limitations here, or with any system with the restrictions that you are asking about. First someone has to keep a list of the allowed applications, an update it regularly. This should be someone like the corporate IT department, it doesn't make sense to put the burdon on the OS vendor as you want the minimum set of applications on your systems and the OS vendor want the maximum set. Secondly this completely breaks software development, for obvious reasons.
I don't currently know of any operating system that implements these features.
Hmmm...with Linux, the only places that regular users can write to anyway is their home directory and /tmp. They need write access to those areas to be able to save stuff. Unfortunately, we probably can't stop them creating or downloading executables to those areas.
/nxhome (no execute home) and mount /nxhome and /tmp as "noexec", that would probably do the trick.
However, mount(8) has a great option - "noexec" - that can be used to prevent files from any partition being executed. If you put restricted users' home directories in
Why doesn't the gene pool have a life guard?
You can mount filesystems with the noexec flag, which will prevent files from being executed. Have user directories mounted like that, and just have executables where users can't write to.
There will always be loopholes in every system.
To (mis)quote Morpheus, "It's a system, and like every system, it has rules. Some of those rules can be bent; others can be broken."
No matter how tight you try to make it, the malware writers will always find a way around it. They may use scripting systems (even this hypothetical closed system would need some sort of scripting capability), or they may find a way to circumvent the lockout mechanism, or any number of other unpredictable ways to get in.
Complete security is a fallacy.
(Spudley Strikes Again!)
In a corporate world, most users should have nothing but a thin client (without USB or FireWire ports). Not only can nothing be installed, but they can't "appropriate" any data, either, if the email outbound filtering is working. Data loss when a desktop crashes is minimal-to-none, with the data on an IT-maintained server. Thin clients CAN be built from diskless boot PCs, but it is often simpler to just buy them than do the research to figure out exactly which packages to build into an initrd image to support your corporate app's. It used to be possible to build diskless M$-Windows systems, but I won't have XP, so I don't know the limitations of it's ramdisk. One trick we used to use on di*kless Sun workstations after disk prices came down was to use a disk for /tmp and swap, rather than the networked drives. 'Could probably be done today with some CompactFlash socketed into an IDE port (something like this: http://www.acscontrol.com/Index_ACS.asp?Page=/Page s/Products/CompactFlash/IDE_To_CF_Adapter.htm).
What happens when a connection that you initiated results in you getting infected with malware that initiates connections rather than listening for connections?
For example:
- LiveJournal ads recently had problems with an advertiser setting their ad to some malware.
- MySpace videos very recently had problems with videos containing malware.
One of the many, MANY hazards with this would be having to buy a supported printer, supported network card, etc... as 3rd party software (and there by hardware) is excluded by definition.
As another poster has mentioned, wouldn't a LiveCD suffice?
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
NetBSD has verified exec option, it doesn't prevent you from being exploited if the kernel is compromised though.
But NetBSD's kernel is extremely well written and as far as I've seen is the one with the best track record of all open source kernels.
Together with the Systrace (by NetBSD developer Niels Provos) you can build extremely secure systems that are super portable.
FreeBSD has similar functionality with its TrustedBSD framework.
I would say NetBSD or FreeBSD is your best bet.
Maybe you can make a Linux install with a subset of the same functionality through SELinux, but I dubt it will be as nice as the NetBSD route.
Why not a list of programs you control? Why does some third party have to decide? Your secretary example demonstrates the need for this, as your OS vendor might decide (and rightfully so) that HL2 is a valid program which can be run. So really, it has to be up to your needs otherwise it is pointless. Furthermore, we already have software which can be used to implement this.
Join Tor today!
What you want is a system that will only run crytographically signed binaries.
However -- like anything else the devil is in the details, or particuarly, in one detail: who controls what apps the OS will run. If it is an OS vendor, that vendor will see that control as a source of revenue, or worse: a way of gaining strategic control over its users (i.e. stay with us on the upgrade path or bad things will happen) or vendors.
Really the owner of the computer should decide who to delegate the job of deciding what to trust. This could be your IT department, or maybe a professional support service (possibly bundled with your ISP service), or your great-nephew whose claim to fame is a four digit Slashdot id.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Without the ability to program the computer, it's usefulness would just go away. What if you want the computer to do something multiple times, telling it to do it more than once is by definition programming it, and as such violates the requirement presented. It just won't happen, the hardware would become a brick.
That it's always possible to teach old programs new tricks :-) like exploring buffer underruns or macro/scripting capabilities or borderline behaviour of many kinds.
Such a system wouldn't be invulnerable at all -- just the fact that you _must_ have some way to upgrade the software (to plug any left holes) opens way to new holes... vide the PSP (2.5/2.6 already hacked, 2.7 probably on its way)
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
What I understood is that locking your doors (or putting an alarm system in your car) makes the thieves go for the unlocked doors (unprotected cars) because they're lazy, right? So, if _you_ lock your door and there is a _lot_ of lusers who use windows^W^W leave their doors unlocked: thieves will become dumber because they will go for the lusers and leave you alone AND for the foreseeable future they will leave you alone because they became dumber. So, no, when you eliminate "casual theft" you are in general upgrading the thieves IQ.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Palms are flexible, loads of software can be downloaded and installed and executed... You must be thinking of the PSP, but even that machine is hacked nowadays (=2.7 via modchip)
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
See this previous comment. I have used this method (in conjunction with LUA accounts) to lock down Windows XP PCs at an internet cafe. It works pretty well IMHO.
The word that comes to mind for me is "payola". The only thing you will get for download is software that is sponsored. Pay the "vendor" the right price and they will certainly "certify" your app. And if it's all proprietary, I doubt anyone but the software developer will REALLY know what's in the code. It's an idea that just has too many exploitable flaws to be "A Good Thing(tm)".
Ok, "payola" is not the right word, but it's what comes to mind. A sponsored work that is not presented as such. It would happen. The idea that we can trust a organization whose motive is profit is asinine. It's something that seems to need to be re-learned with every generation.
Sig
Appended to the end of comments you post. 120 chars
This won't work. How do you define ``program''. If ``program'' means an executable, then you have a problem. Suppose one of the whitelisted applications was perl. In that case, you run perl with your file and boom! You have a program. And the computer can't even figure out that the Perl script is a program, since it does not understand it.
And there are tons of others as well. No interpreters? Fine. You can use Excel macros for God's sake!
Thats a feature to protect children (and maybe Apple fanbois, since they have the same IQ). Against a malicious attack, it would not stand a chance. Its like leaving a sign saying "Do not steal" on your car to prevent it from being stolen.
I am supprised noone has mentioned http://www.skyos.org/
While not purely "Closed" it is a commercial OS that runs only what has been programmed just for it, all which is included in the OS
That's not a problem, I did set up some public school terminals recently, with every user having their account. The terminals are netbooted with a read-only rootfs (NFSv3), home directories are mounted read-write trough a PPPoE tunnel authenticated with the users's login and password (= only the active users's home directory is mounted), and, the most important thing, the system is equpped with full grsecurity framework, ACLs, TPE (Trusted Path Execution, simply the user is unable to run anything that I didn't allow him to), restricted scripting languages and a few more simple tricks. That, and KDE running with some kiosk options turned on, makes an unbreakable system, at least as long as the users are not Mitnicks - and, in the least likely case of a break-in, even every single exec() is logged off-site, just waiting to print it and hand over to the headmaster (or, had it been a company, the boss). Of course, the system won't even run when there's no connection with the external logging daemon, so unplugging it for a few minutes to hide something won't do.
This is Slashdot. Common sense is futile. You will be modded down.
There's the infamous ld-linux.so workaround for -noexec mounts... but does ld-linux.so really need to me +x if it is only called (legitimately) by other executables? I don't really have any place I can test this theory at the moment...
SIG: HUP
The only flaw (not really a flaw, but an unintended side effect) with this is that the user's .bashrc and the like will not be executed, since these are essentially shell scripts that generally need execute permission. But, other than that, it should work...
We alerady have this. Citrix and winterminals. The users get only the applications published by the admin, can only save the data allowed by the admin in the shares designated by the admin. Its certainly not perfect from a security perspective, but it does more or less what the OP asked.
If privacy had a tombstone it would read "We did it for your own good" . -- John Twelve Hawks
This already exists in mobile phones. Some phones provide a JVM that lets you run code in a sandbox, but their bootloaders check an RSA signature before executing the operating system, and the operating system checks signatures on the Java classes before giving them privileges. It's how the phone companies get away with charging you an arm and a leg for ring tones and wallpapers.
http://outcampaign.org/
Yeah, that's great, until the company goes out of business, or (for a really fun thought) loses the encryption keys (due to fire, flood, terrorist bombing or BOFH...) Now you're forever stuck with whatever their last release was, and you may not ever get new software.
- "History shows again and again how nature points out the folly of men" -- Blue Oyster Cult, 'Godzilla'
Speaking as a user who understands their computer reasonably well and doesn't click on stuff just because animated characters tell me to, would this be a good thing?
The problem isn't "lusers". The problem is the whole security model is broken. Every software application on your computer has the ability to steal your bank password and transmit it across the net. Can you vouch for the millions of lines of software for every application that you have installed? All it takes is one rogue programmer.
The SkyNet Virus: Why it is Unstoppable; How to Stop it
open source OS'es will certainly help hackers develop malicious code like rootkits , troajans faster n complicated ..but won't they develop malicious code if d source is not known..now a days variety of reverse enginnering techniques n code analyzing techniques r coming up.. it's always just a matter of time.. n how much u r willin to pay 4 it.. n hackers have it all.. but on d other side it will help other ppl provide solutions easily,... otherwise even if u r coding for a third party product . n the opertaing system got a security problem.. or a backdoor.. even ur a application is a at risk..
The vast majority of businesses either have an organically "developed" set of processes to run the business, or no real processes at all. By "process", I mean a structured and understood (by all necessary staff) flowchart of who does what when, and how thier outputs affect other's inputs. Even if the set of processes has come about organically (ie, trial and error over many, many years and employees, turnovers, etc), it is likely that no one person understands the actual "logical" flow behind thier (or anyone else's) decisions, and the effects of those decisions.
The reality is that, even in those businesses which seem to run well using an organic approach, inevitably there will be waste and errors. If you tried to flowchart the business process of any one area, you would find all manner of strange results, just like you find in any other organically evolved system. While they do "work", they can also break very easily - indeed, it may be this one person who seems to take no input or produce no output, who is actually necessary (in some weird manner) for the functioning of the company - eliminate him (by thinking he is unnecessary), and the company could implode (there are many concrete examples of this in organically developed "evolved" circuitry and neural network systems to illustrate this point).
The processes which define how a business runs is merely the systems-level view of the business as a logical computational machine, whose function is to take the input of customers, produce some form of output to them, as well as profit. In most businesses, the processes are defined poorly or not at all. Those that are defined poorly tend to be those companies who recognize that there are processes that define the business, but don't flowchart and fix the irregularities (and/or inefficiencies) of their organically developed processes, and instead opt to graft on to the existing processes developed and defined processes, without understanding what those defines processes will do to the overall organic process (ultimately, though, this is just another example of an organically defined system). Those businesses that have processes that are not defined at all tend to have nothing but organically defined processes and are loath to look at or change them, for fear of the business imploding. The ole' "It'll break if you look at it crosseyed" syndrome.
Businesses (and the people who run them and are employed by them) are sometimes fearful to look at and understand them as the complex logical machinery that they are. It is the same fear (although at a much larger scale) which keeps most people from understanding how computers work. Most humans see logical and rational processes (whether a business, a computer, or their own within their own self) as dehumanizing or wrong for some insane reason, even though humanity is more than capable of thinking in this manner, since it is required to start a business, build a computer, or merely to exist (without dieing in the short term). However, if they want the system as a whole to last longer than a generation (tops), they need to understand and know the underlying processes which guide that system, if they want those systems to stay homogeneous. Otherwise, the only other method (known to work, although highly inefficient) is to follow nature's path - somehow introduce reproduction into the system (spinoffs and corporate restructure/mergers come to mind as methods which have been tried with mixed success). This is the model most businesses seem to be following, despite the massive amounts of inefficiencies that result from such systems.
So - what is the result of all this? Well, the inefficiencies and waste can cause any number of symptoms, the least problematic of which is employee "downtime" (and employee turnover). High product failure rates (before or after shipping), deadline slippage, and budgetary wast
Reason is the Path to God - Anon
I will never have to worry about my 1994 4-banger Ranger being stolen, even if left unlocked with the keys in it (plus, it is paid off and insurance/registration is really, really low)...
Reason is the Path to God - Anon
It's called "Trusted Computing".
Next question, please?
-- There are two kind of sysadmins: Paranoids and Losers. (adapted from D. Bach)
Of course, you have the problem of interpreted languages (macros), DHTML, java applets, etc etc. And you couldn't ever develop software for this OS, or even ON this OS.
Useful perhaps in a call center, but there's already solutions for that.