Errata Security

Robert Graham had a rebuttal, too, and he mentions how Let's Encrypt for instance is quite vulnerable to sophisticated attackers employing DNS spoofing attacks against it:

https://blog.erratasec.com/2018/04/no-ray-ozzie-hasnt-solved-crypto.html

Also, I think most would agree that CAs are quite terrible at security. It's part of the reason why everyone thinks the CA system sucks and is not trustworthy and it's also why Google has been pushing for Certificate Transparency to be able to verify if the CAs (or people hacking the CAs) are misbehaving. But it's still a patch on a broken system.

And look what's been happening with Symantec, too, the largest CA. They were terrible at managing the infrastructure in a secure manner. There are thousands of different CAs. Most are probably insecure or hacked, we just haven't learned about it yet.

Also, if you read Green's post, he mentions how this wouldn't be like the CA/software signing system at all. In those systems, you can revoke the certificate. If someone gets the master key for 500 million iPhones, those phones will either need to be bricked or they will remain vulnerable forever.

If the NSA/FBI would learn that the system was compromised, they'd never tell us about it either, because they'd know people would then be pushing for the removal of the system, and they wouldn't want that after fighting for so long for something like it.

I think Ozzie is being very irresponsible pushing for this. And the reason he is being this…

The idea is that the DSL compiler would be responsible for ensuring constant-timeness. Note that C, C++, and Rust offer no guarantee of constant-timeness. Even processors don't offer constant-timeness guarantees and some instructions (often division) are not constant-time. See also http://blog.erratasec.com/2015/03/x86-is-high-level-language.html.

I wrote the paper mostly in the context of implementing signature verification, which doesn't require side-channel protection since there are no secrets in verification. But, I think the DSL approach is even more important for ECDH and signing, where side-channel protection is important.

Finally, given that processors don't even promise us that any instruction is constant-time, and given that other types of attacks are possible where constant-timesness doesn't help so much (e.g. power analysis), I think it is worth considering other approaches to side-channel protection (e.g. blinding). For many applications, constant-timeness isn't sufficient and I'd love to learn that it isn't necessary.

> i.e. How did Snowden get on an Aerofloat flight out of HK almost a week after the manhunt started?

Because Hong Kong let him go, as he wasn't officially wanted at the time:

> as the US had revoked his passport (and issued an arrest warrant) and notified Hong Kong of the revocation a day before the plane took off. However, as numerous news reports of the time reported, the US information [in the arrest warrant] was contradictory and incomplete, and thus Hong Kong did nothing to stop Snowden from leaving [0]. The Guardian [1] quotes a Hong Kong official as saying Snowden left "through a lawful and normal channel".

The rest of that blog post is worth a read:

http://blog.erratasec.com/2016/12/your-absurd-story-doesnt-make-me.html

[0] https://web.archive.org/web/20130822210647/http://www.thestandard.com.hk/news_detail.asp?pp_cat=30&art_id=134957&sid=39870263&con_type=1&d_str=20130626&isSearch=1&sear_year=2013

[1] https://www.theguardian.com/world/2013/jun/23/edward-snowden-arrives-moscow

Assorted pointers:

http://danluu.com/clwb-pcommit/ on the speed of modern persistent storage and the need to get the OS out of the way for best performance

http://blog.erratasec.com/2013/02/custom-stack-it-goes-to-11.html on the speed of modern networking and the need to get the OS out of the way for best performance

http://joeduffyblog.com/2015/12/19/safe-native-code/ and the rest of that blog on Microsoft Research's Midori research OS, based on C# and type safety rather than traditional process-based (i.e. Memory Mapping Unit-based) security

https://sel4.systems/ for a proven-secure (with many asterisks) native-code microkernel

MirageOS (OCaml) and similar (often Rust-based) unikernels

... and of course, the rise of the heavyweight microkernel under the name "hypervisor"

Each of these ideas has very serious downsides, but each also has earnest proponents.

Sorry, but no. Compensation is highly relevant. Do you work for free? Or do you just not consider security research to be worth anything?

Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others.

We can easily spin it the other way too after all - one could say that the largest, most profitable company in the world has a moral obligation to compensate those that are protecting their users where they failed to.

For reference:
http://www.digitalbond.com/about-us/vulnerability-disclosure-policy/
http://erratasec.blogspot.com/2011/09/finally-responsible-disclosure-policy.html
http://www.securityfocus.com/brief/933
http://trailofbits.com/2009/03/22/no-more-free-bugs/

This is an excellent essay, and touches on a lot of the key ideas both of what C is and of how C maps to the hardware. In particular, I completely agree with where Steve lands here, which is that C can give you more understanding of how computers work but won't necessarily reveal some "deep ultimate truth" about the zen of computers. Especially in light of this essay recently shared on HN (https://blog.erratasec.com/2015/03/x86-is-high-level-language.html), which makes the excellent point that even a language that is compiling down to raw x86 assembly is still operating in a "virtual machine" relative to what goes on in the actual chip and the flow of electrons through the silicon-metal substrate.

It's abstractions all the way down.