51–60 of 128 posts
Earlier quoted context omitted.
Indeed. "Move fast and break things" might not be the best idea in this particular case.
Isn‘t this the very definition of an ICBM?
Yet it definitely is designed for that.
I wonder if they ever feels frustrated.
This was the system used to pass early warning to the Patriot anti-missile (Scud) batteries during the first Gulf War.
Internetworking the Air Force system to an Army system was considered revolutionary in 1991. Today, it would be equivalent to "stone knives and bearskins".
So when we upgrade the hardware, how much of it will be sourced from China? Is it even possible to fully secure the supply chain? Introducing any outside code or hardware is a liability. Unless there is a really urgent problem, I think they should just freeze their entire computer platform, that way they can eliminate any chance of any new threats. I can not possibly imagine any cost justification for doing so. I hav…
Almost spilled my coffee reading this one.
> You can't hack something that doesn't have an IP address. That's a very risky assumption to make. There are many attack vectors besides TCP/IP: social engineering, side-channel attacks, EM pulse, backdoors in ICs...
Remote sabotage from anywhere and spies roaming the cooridors are quite different things.
The claim is: "No IP address == unhackable."
So, for a second stop assuming we are in a nuclear bunker. There are many unconnected systems that are still hackable. For example, the Stuxnet worm was able to infiltrate an unconnected SCADA system using USB exploits. Many systems radiate data in EM and ultrasonic (side-channel). And obviously, there are known and unknown backdoors in PCBs, ECs, and ICs. All of these do not require an IP address.
I would even argue that having an IP address can improve security by increasing monitoring, improving continuous security updates and decreasing a false sense of security. This was the original goal of DARPA all along.
> While SACC’s hardware is decades old, its software is constantly refreshed by young Air Force programmers who learn software development skills at Offutt’s Rapid Agile Development Lab. I am not so sure I want “Rapid Agile” development for something that literally controls nuclear missiles.
A guide from the US DoD on "detecting agile BS" popped up here several months ago, so I think someone there might agree with you on that (edit: nevermind -- looks like they embrace agile but this document is about detecting waterfall or spiral development pretending to be agile) https://media.defense.gov/2018/Oct/09/2002049591/-1/-1/0/DIB...
The final release of that paper along with other SWAP study publications can be found here[2].
So when we upgrade the hardware, how much of it will be sourced from China? Is it even possible to fully secure the supply chain? Introducing any outside code or hardware is a liability. Unless there is a really urgent problem, I think they should just freeze their entire computer platform, that way they can eliminate any chance of any new threats. I can not possibly imagine any cost justification for doing so. I hav…
FYSA[1], would it surprise you if that figure was precisely zero?
In the 80's, I was the project engineer for the Air Force DSP satellite ground communications network upgrade. This system used a 20 MB Bernoulli Box to store the early warning messages. It was replaced in 2005. This was the system used to pass early warning to the Patriot anti-missile (Scud) batteries during the first Gulf War. Internetworking the Air Force system to an Army system was considered revolutionary in 19…
I know of several military systems that still use floppy disks, that comforts me for a few reason: * Their maintenance is well understood - every fault that is likely to happen has happened and has been recovered/repaired from. It's very unlikely there will be new surprised down the road. * Their degradation is well understood - it's been around long enough that parts have failed and have been repaired. * Isn't easil…
This could be a sign that a new generation of technologies are reaching a similar level of reliability.
Long term reliability metrics can only be gathered for technologies that have already been deployed in the long term. That’s why many mission critical applications like this one use “obsolete” technologies.
...or perhaps it's a much more simple risk probability v. consequence severity decision?