News for hackers. Stuff that matters.

A comment on Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks. Parent comment

Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by java-man on Tuesday August 13, 2019 @11:29AM (#20686757)
I wonder if there is a company that's really interested in developing a secure (by design) operating system. Apart from you-know-who?
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by ChuckMcM on Tuesday August 13, 2019 @01:12PM (#20687879)
There have been efforts to do this. Back during the first crypto-wars I had some code in Java that would give it capabilities similar to the way that the language Joule did it (basically the class loader would elide any methods from the loaded class based on capabilities so they weren't even available) I got a couple of patents out of it but sadly the politics inside of Sun kept it from going anywhere useful.

Highly constrained OSes and languages that do so in order to minimize attack surface tend to be challenging to work in. As a result they constrain productivity which increases time to market and the folks who got something out, even insecure, would "win" the market. It was a sad thing to see happen.

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by jnwatson on Tuesday August 13, 2019 @01:57PM (#20688447)
I found that working on Green Hills' Integrity was quite a bit easier than working in user space on a typical UNIX userspace. The primary reason is that the API for Integrity was designed in the late 90's, where the POSIX API was inherited from the first thing folks thought of in the late 70's.

The other aspect was that IPC via message passing is a very natural way to program.

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by jnwatson on Tuesday August 13, 2019 @01:50PM (#20688361)
Take a look at seL4 [1].

That it has never taken off is more evidence that there's no money in securing software, just cleaning up the mess insecure software leaves behind.

1. https://sel4.systems/

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by javert on Tuesday August 13, 2019 @04:51PM (#20690101)
Is it true that seL4 has never "taken off"? And might it be too early to tell?

I am under the impression that the people behind seL4 have managed to successfully commercialize earlier other versions of L4 before seL4 was created.

Anyway, even if we grant the premise that seL4 has not taken off, that does not seem to justify saying that there is no money in securing software.

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by irundebian on Tuesday August 13, 2019 @06:10PM (#20690760)
seL4 just celebrated its 10th anniversary. seL4 isn't widespread in COTS systems but rather in high assurance government systems as explained in this blog post: https://microkerneldude.wordpress.com/2019/08/06/10-years-se...
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by twic on Tuesday August 13, 2019 @05:59PM (#20690691)
SeL4 is a small microkernel, not a complete operating system. It is very, very cool, and deserves more adoption, but a customer would need a load of stuff on top of it for it to be a viable option.
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by dplavery92 on Tuesday August 13, 2019 @12:56PM (#20687656)
I don't know who.
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by yellingdog on Tuesday August 13, 2019 @12:36PM (#20687437)
GHS Integrity?
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by java-man on Tuesday August 13, 2019 @01:00PM (#20687723)
https://nvd.nist.gov/vuln/detail/CVE-2019-7715

https://nvd.nist.gov/vuln/detail/CVE-2019-7711

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by jnwatson on Tuesday August 13, 2019 @01:46PM (#20688318)
Wow that's a blast from the past. That's well over 12 years old (maybe 14?) software, third party to Integrity.
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by dls2016 on Tuesday August 13, 2019 @01:17PM (#20687925)
They have a cool T-rex skull in their office.

https://twitter.com/phil_torres/status/700115845540765697

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by sp332 on Tuesday August 13, 2019 @12:27PM (#20687330)
OpenBSD?
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by java-man on Tuesday August 13, 2019 @01:03PM (#20687756)
https://www.cvedetails.com/vulnerability-list/vendor_id-97/p...

I might hazard to say that (in my opinion) no OS written in a memory unsafe language is secure by design.

[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by tadfisher on Tuesday August 13, 2019 @01:52PM (#20688393)
Tock might fit the bill then (Rust): https://www.tockos.org/documentation/design
[ Parent | on HN ]
Re:Urgent/11 – Zero Day Vulnerabilities Impacting VxWorks by somesortofsystm on Tuesday August 13, 2019 @03:44PM (#20689498)
THALES has put Linux into battle mode.

EDIT: bzlg. SYSGO GmBH

[ Parent | on HN ]