> You can't hack something that doesn't have an IP address.
That's a very risky assumption to make. There are many attack vectors besides TCP/IP: social engineering, side-channel attacks, EM pulse, backdoors in ICs...
The US nuclear forces’ messaging system finally got rid of its floppy disks
41–50 of 128 posts
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#42To be perfectly honest, I'd rather they used floppy disks than the latest trendy JavaScript frameworks.
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#43I was kind of hoping they were replacing the floppy disks with CDs or something else equally old school and hard to hack.
Old school tech is ridiculously easy to hack. New tech is much more hardened. The only advantage old tech has is that it doesn’t have peripherals that connect to the internet. At the end of the day the most secure computer is a new one, that isn’t on the internet, and is physically secure.
Old computers don't have whole computers built into the motherboards running inaccessible operating systems that can't be switched off.
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#44> While SACC’s hardware is decades old, its software is constantly refreshed by young Air Force programmers who learn software development skills at Offutt’s Rapid Agile Development Lab. I am not so sure I want “Rapid Agile” development for something that literally controls nuclear missiles.
`git commit -m “added factoryboy to generate random target coordinates to test the launch sequence.”` `git commit -m “Fuck fuck fuck, forgot to replace the launch API endpoint with a mock one.”` Scrum master: “Let’s implement the stuff with the highest customer value first.” Developer A: “I guess that means being able to launch the nukes.” Developer B: “Yeah. Auth can come later.” Developer C: “Nobody answered us abo…
So, who thought it was a good thing to have CI/CD on this anyway? Is that NORAD on the phone?
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#45Earlier quoted context omitted.
As far as I know, we don't even know the length of time CDs will last because they haven't been around long enough. I would love someone to correct me if I'm wrong.
CDs already get disc rot, sometimes just after a few years if they are cheap. Don't forget, CDs have been out since 82, and they were not the first optical disc format around, either. Tapes however, can last 50+ years. It's a much better medium than most think it is, for analog or digital storage. Heck, a reel to reel tape unit offers the best analog sound quality you can get.
But the optical discs from before the CD era used gold as the base material, CDs use Aluminum.
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#46> You can't hack something that doesn't have an IP address. That's a very risky assumption to make. There are many attack vectors besides TCP/IP: social engineering, side-channel attacks, EM pulse, backdoors in ICs...
Remote sabotage from anywhere and spies roaming the cooridors are quite different things.
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#47> While SACC’s hardware is decades old, its software is constantly refreshed by young Air Force programmers who learn software development skills at Offutt’s Rapid Agile Development Lab. I am not so sure I want “Rapid Agile” development for something that literally controls nuclear missiles.
Don't forget this is the US military, home of the tortured acronym. I mean (man), this is totally RAD. They're making Star Wars and Star Trek references, so 'rad' is cool too, right? Or it's an early/late 1st April story.
RAD is an Agile methodology very Agile eg Daily Sprints
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#48Earlier quoted context omitted.
`git commit -m “added factoryboy to generate random target coordinates to test the launch sequence.”` `git commit -m “Fuck fuck fuck, forgot to replace the launch API endpoint with a mock one.”` Scrum master: “Let’s implement the stuff with the highest customer value first.” Developer A: “I guess that means being able to launch the nukes.” Developer B: “Yeah. Auth can come later.” Developer C: “Nobody answered us abo…
So, who thought it was a good thing to have CI/CD on this anyway? Is that NORAD on the phone?
"Oops, we nuked our staging database. Literally."
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#49I know of several military systems that still use floppy disks, that comforts me for a few reason: * Their maintenance is well understood - every fault that is likely to happen has happened and has been recovered/repaired from. It's very unlikely there will be new surprised down the road. * Their degradation is well understood - it's been around long enough that parts have failed and have been repaired. * Isn't easil…
This could be a sign that a new generation of technologies are reaching a similar level of reliability.
Re: The US nuclear forces’ messaging system finally got rid of its floppy disks
#50> While SACC’s hardware is decades old, its software is constantly refreshed by young Air Force programmers who learn software development skills at Offutt’s Rapid Agile Development Lab. I am not so sure I want “Rapid Agile” development for something that literally controls nuclear missiles.
A guide from the US DoD on "detecting agile BS" popped up here several months ago, so I think someone there might agree with you on that (edit: nevermind -- looks like they embrace agile but this document is about detecting waterfall or spiral development pretending to be agile)
https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB...