The marketing makes it sound a bit like SeL4.
https://sel4.systems/
Kaspersky OS
71–80 of 290 posts
Re: Kaspersky OS
#72Happy Pocky Day! (11-11)
Re: Kaspersky OS
#73Earlier quoted context omitted.
Also, in a microkernel-based system, verifying the kernel itself is but a start. To make a verifiably secure system for network infrastructure and IoT-devices, you need, at the very least, a provably correct IP stack. Want a nice web interface? Now you need to verify the HTTP server, too. Want to talk to other devices? You probably want a DNS resolver. And so forth... Simply signing code and having the OS refuse to e…
But isn't an isolation kernel enables you to limit spread of malware between modules and to detect when a module was compromised and reset it ? Isn't that a big improvement ?
It certainly is an improvement.
But my point was that it still leaves a whole lot of attack surface. If you want a provably secure system, you basically need to verify much more than "just" the kernel.
On the upside, if one did so, it would have benefits beyond security.
Re: Kaspersky OS
#74"not even the slightest smell of Linux." So me too I have a dream. In my dream, every shop that needs two threads running and one semaphore synchronizing, will cease porting Linux and instead will roll up the sleeves, writes their own kernel 100% matching their need, prove its validity via formal verification and then use it. In the world where this is possible, why would one go for a non-generic OS from a third part…
> writes their own kernel 100% matching their need, prove its validity via formal verification It's hard enough for one organisation to do this, given the fairly specialised set of skills it requires. Let alone every IoT vendor. There's no reason to massively replicate this kind of work. People would be better off building an ecosystem around sel4.
Agree, I'd like exactly to look closer inside "hard enough".
First, it depends on each specification -- what if the hardware is much-much smaller (IoT) and task to perform is well defined? It is hard today primarily because the required skill set becomes less and less current, but it is all demand-driven, it was not so some time ago.
Secondly, it could be replicated to some extent only -- for example, verified libraries for each device could come from each HW IP provider, instead of coming from the SoC vendor who integrated them. Say, Synopsis would provide a verified lib for the GbE controller -- to use with all SoCs that integrate it, etc. And the final integrator would take care of verifying the final integration, including his very small, fast, low-power-consuming and maintainable and 100%-dedicated kernel.
But my main argument is that the alternative is not so good-looking either. Porting and validation of the Linux kernel is performed mostly by engineers who have not the required skillset (managerial decision to spare on hires since "we have Linux") -- this is also something that I wish wasn't replicated among product makers but is, unfortunately.
Re: Kaspersky OS
#75Earlier quoted context omitted.
From what I heard from people that work there, this company mistreats employees and has huge problems with management. I could provide a proof link, but it's in Russian.
Go ahead and provide it, Russian or not.
Re: Kaspersky OS
#76Earlier quoted context omitted.
From what I heard from people that work there, this company mistreats employees and has huge problems with management. I could provide a proof link, but it's in Russian.
It is preferable to even outright include the link in the original post when making that sort of statements. Without specific details, it sounds pretty much like any random Glassdoor report from un unhappy employee.
Re: Kaspersky OS
#77Earlier quoted context omitted.
From what I heard from people that work there, this company mistreats employees and has huge problems with management. I could provide a proof link, but it's in Russian.
It is preferable to even outright include the link in the original post when making that sort of statements. Without specific details, it sounds pretty much like any random Glassdoor report from un unhappy employee.
Re: Kaspersky OS
#78Earlier quoted context omitted.
Yet it's not widely used as embedded OS. I never saw any router with OpenBSD or web camera. The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. Also it's not clear how many vulnerabilities, used in real life attacks (like DDOS from IoT devices) are in latest Linux kernel? May be problem not with Linux, but with custom software or lack of updates.
These two statements contradict each other: > The underlying problem, IMO, is people. They just don't care about security, they want to deliver working device. > This unassuming black box is [...] designed for networks with extreme requirements for data security. You can claim that nobody will buy Kaspersky's device, or that they did poor market research. But you can't claim that they don't care about security.
Kaspersky certainly care about security, it's their business. I'm talking about people who build routers or web cameras. I doubt that Kaspersky built OS for internal use, they want to license it to other manufacturers. But I'm not sure that other manufacturers will want to pay for this extra security (if they would want, they already have better options).
Re: Kaspersky OS
#79Security through obscurity. I thought we all have learned that it doesn't work. Well, good riddance, KasperskyOS! "And then there are some details that will remain for certain customers’ eyes only forever, to ward off cyber-terrorist abuses." https://eugene.kaspersky.com/2012/10/16/kl-developing-its-ow...
I agree. What I find interesting is that real world security is also a function of popularity. You won't get many outside hackers to attack a platform, if it's hardly used. So any new platform would first need broad adoption, then a few years of maturity in able for the outside world to assess if it's more secure than current systems. Obviously, security centric design helps a lot, but on the other hand Kaspersky is…
Popularity is not exactly what attracts most hackers nowadays; it's profit.
Yes, in the common case, the more popular the system, the more profit can be made by hacking it. But if a system is running on a few, but very strategic places, it will be an interesting target and thus attract a lot of effort.
Re: Kaspersky OS
#80No word on if this is FLOSS or not in the article so I'm assuming it'll be something closed. Which essentially renders the entire exercise moot form my POV. I also don't like how they mentioned Linux. They make it sound as if (a) Linux is very insecure...I'm no expert but I'd like to see them prove their system is more secure than a Linux distro dedicated to security. (b) Linux is the only viable option. There's plen…
Linux is very insecure. Maybe you have not been following the news lately.