Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet centralization and the original sin of NAT

dreamstation.systems

Post reply on HN
Print view View original

191–197 of 197 posts

Re: Internet centralization and the original sin of NAT

#191

Post by mikewarot »

GoblinSlayer wrote: post #185
mikewarot wrote: post #46

Earlier quoted context omitted.

All of the current OS choices are insecure by design. The all operate programs with the ambient authority of the user. While this was fine for the corporate world of AT&T in the 1970s, and the classroom in the 1980s, it's insane to use it in the era of ubiquitous persistent megabit Internet connectivity, and mobile code. I know of zero systems that can survive exposure to the raw Internet, unpatched and without admin…

> The all operate programs with the ambient authority of the user. Doesn't mean much when you have a buffer overflow in kernel.

Which is part of why Tanenbaum was right, and Linus Torvalds is dead wrong.[1]

Eventually, we'll all be running Operating Systems designed on microkernels, which have been written by actual software engineers, and proven correct with formal methods.

Until then, we're going to suffer through endless series of increasingly severe cybersecurity incidents.

Computer Security is a solved problem, has been since the mid 1980s, secure proven microkernels, with almost all code in user space, capabilities based security, etc. have been just waiting to move into mainstream use.

We can end this nightmare.

[1] https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_deb...

Re: Internet centralization and the original sin of NAT

#192

Post by AnimalMuppet »

mikewarot wrote: post #191
GoblinSlayer wrote: post #185

Earlier quoted context omitted.

> The all operate programs with the ambient authority of the user. Doesn't mean much when you have a buffer overflow in kernel.

Which is part of why Tanenbaum was right, and Linus Torvalds is dead wrong.[1] Eventually, we'll all be running Operating Systems designed on microkernels, which have been written by actual software engineers, and proven correct with formal methods. Until then, we're going to suffer through endless series of increasingly severe cybersecurity incidents. Computer Security is a solved problem, has been since the mid 198…

Eventually? I've seen more than forty years of OSes that "we're all running". Given past trends, your "eventually" we'll be after we're all dead.

There isn't such a thing as you describe. There isn't a trend toward such a thing as you describe. What there is, is Windows 11, and Linux, and OSX. And when people complain that Windows 11 stinks, they're mostly complaining about the UI and the ads, not about the security or the lack of formal methods or the lack of a microkernel.

The closest there is to what you're describing is SELinux. It's still a monolithic kernel. (Though I think it did use formal methods, but I'm not sure of that.) The only microkernel candidate that I know of is the Hurd, and it isn't what we're all running, and shows no sign of becoming so.

Re: Internet centralization and the original sin of NAT

#193

Post by Dagger2 »

tptacek wrote: post #154
unethical_ban wrote: post #105

Earlier quoted context omitted.

You are correct. The reason NAT is seen as security on home networks is that, absent a firewall, it acts as a default deny to inbound traffic.

In other words, the reason NAT is seen as security is that it provides security (imperfectly, like almost everything else).

No, the reason is that people incorrectly believe it provides security.

It doesn't actually do that.

Re: Internet centralization and the original sin of NAT

#194

Post by tptacek »

Dagger2 wrote: post #193
tptacek wrote: post #154

Earlier quoted context omitted.

In other words, the reason NAT is seen as security is that it provides security (imperfectly, like almost everything else).

No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.

I know that's an article of faith among networking people but it's not actually true.

Re: Internet centralization and the original sin of NAT

#195

Post by Dagger2 »

tptacek wrote: post #194
Dagger2 wrote: post #193

Earlier quoted context omitted.

No, the reason is that people incorrectly believe it provides security. It doesn't actually do that.

I know that's an article of faith among networking people but it's not actually true.

It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones.

You don't need to take that on faith either -- you can just test it.

Re: Internet centralization and the original sin of NAT

#196

Post by tptacek »

Dagger2 wrote: post #195
tptacek wrote: post #194

Earlier quoted context omitted.

I know that's an article of faith among networking people but it's not actually true.

It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.

Go ahead, make an inbound connection to my dev laptop. I'll even give you the IP address: it's 192.168.8.21.

Re: Internet centralization and the original sin of NAT

#197

Post by Dagger2 »

tptacek wrote: post #196
Dagger2 wrote: post #195

Earlier quoted context omitted.

It is true. NAT only changes the source address used for outbound connections, it doesn't deny inbound ones. You don't need to take that on faith either -- you can just test it.

Go ahead, make an inbound connection to my dev laptop. I'll even give you the IP address: it's 192.168.8.21.

Get me onto the network that's on the WAN interface of your router, disable the firewall on it, and I will.

How do you want to go about doing this? Although, 100% of the time people have asked me to do this they chicken out at actually doing it, so I suppose you will too. You might prefer to test with some network namespaces instead.

Post reply on HN