Live data from Hacker News

Binary Authorization for Borg

cloud.google.com

11–20 of 60 posts

Re: Binary Authorization for Borg

#11
post #10

I led the portion of this project on Borg itself. Security team did most of the security infrastructure, and coordination among almost every large infrastructure system team inside TI. I'll be waiting for them to answer any questions. :)

I've seen references to gVisor being used 'in production' for google app engine && cloud run and so forth. Scanning through recent commits && the github repo this is clearly not the case - there are way too many outstanding issues and outright missing support for various things. Is this another project where it was written in a different language or something and then ported out? Can you clarify?

I cannot say anything about internal use of gVisor. Sorry.

As a bystander from outside, I generally don't like VM type of mechanism as security mechanism. Unless it's actually a VM hypervisor. That way hardware can be utilized to define a relatively simper and more robust security model. (Of cuz, not saying hardware is always superior please don't chase me on this direction).

On the contrary, true software sandbox like ebpf and webassembly with limited capabilities in its building blocks and clearly defined application scenarios, are better ways to do security in software.

Re: Binary Authorization for Borg

#12
One thing that really squicked me out when I left Google is how other companies, even large and sophisticated ones, are using all kinds of garbage that comes from canonical or red hat or percona, and they have NO IDEA what's in there. Say what you want about google's NIH culture, but in regards to code provenance and verifiable builds they are doing the right thing and many others are not.

Re: Binary Authorization for Borg

#13
post #12

One thing that really squicked me out when I left Google is how other companies, even large and sophisticated ones, are using all kinds of garbage that comes from canonical or red hat or percona, and they have NO IDEA what's in there. Say what you want about google's NIH culture, but in regards to code provenance and verifiable builds they are doing the right thing and many others are not.

Can you give an example of this garbage?

Re: Binary Authorization for Borg

#14
post #12

One thing that really squicked me out when I left Google is how other companies, even large and sophisticated ones, are using all kinds of garbage that comes from canonical or red hat or percona, and they have NO IDEA what's in there. Say what you want about google's NIH culture, but in regards to code provenance and verifiable builds they are doing the right thing and many others are not.

Can you give an example of this garbage?

Literally anything that comes from a vendor in a package? Percona server/toolkit? Every binary package in Ubuntu? The Linux kernel as built and distributed by Red Hat?

Re: Binary Authorization for Borg

#15
post #12

One thing that really squicked me out when I left Google is how other companies, even large and sophisticated ones, are using all kinds of garbage that comes from canonical or red hat or percona, and they have NO IDEA what's in there. Say what you want about google's NIH culture, but in regards to code provenance and verifiable builds they are doing the right thing and many others are not.

Whilst it would be nice if everyone had the time and resources to code review and build their entire source dependency tree, is this ever going to be a reality for the long tail of enterprises who struggle with even resourcing / recruiting for their current workload? I think the vast majority are going to continue outsourcing this responsibility onto enterprise distros / vendors for a long time to come.

Re: Binary Authorization for Borg

#16
At Microsoft, we just require all binaries to be signed on production systems. Some systems are configured to block execution 9f unsigned code. Where we can't do that, monitoring cuts an immediate sev-2 and wakes us up if any unsigned code is executed.

Does Linux not have a way to run only signed ELFs?

Re: Binary Authorization for Borg

#17

At Microsoft, we just require all binaries to be signed on production systems. Some systems are configured to block execution 9f unsigned code. Where we can't do that, monitoring cuts an immediate sev-2 and wakes us up if any unsigned code is executed. Does Linux not have a way to run only signed ELFs?

Once configured, the IMA appraisal subsystem in the Linux kernel can ensure that only signed code executes.

Re: Binary Authorization for Borg

#18

On a related note, we have built an E2E-verified, tamper-evident CI/CD pipeline for the Datadog Agent integrations [1]: the Agent will trust and install only integrations that correspond to source code that have signed by our developers. If there is an attack anywhere between our developers and end-users, it will be caught. Unlike Binary Authorization for Borg, our security guarantees are publicly verifiable. [1] htt…

I saw this before and meant to post about it, because it's really neat.

Re: Binary Authorization for Borg

#19
post #6

> We want to have confidence that the administrators who run the systems that access user data cannot abuse their powers. So "Binary Authorization for Borg" is a defense against getting Snowdened.

It's more a defense against getting NSA'd (via the specific threat model of an attacker secretly replacing a security service with an implementation that looks very similar but is much easier to crack).

More generally you might say it supports rule of law. If something happens according to procedure then it's ok.

You might not think that's much of a guarantee, but it beats the alternative where things happen due to shadow processes.

Re: Binary Authorization for Borg

#20

On a related note, we have built an E2E-verified, tamper-evident CI/CD pipeline for the Datadog Agent integrations [1]: the Agent will trust and install only integrations that correspond to source code that have signed by our developers. If there is an attack anywhere between our developers and end-users, it will be caught. Unlike Binary Authorization for Borg, our security guarantees are publicly verifiable. [1] htt…

That's a bit of disingenuous reply...

Binary Authorization for Borg is for verifying binaries running inside Google, not code installed on end-user machines. Having the authorization be "publicly verifiable" makes no sense.

Post reply on HN