News for hackers. Stuff that matters.
Re:U.S. tightens export controls on items used in surveillan... by mikewarot on Wednesday October 20, 2021 @09:36PM (#28939254)
It has been within our technical capabilities to totally seal off the land border since WWII. What is lacking is the will to do so. There are many reasons we let the borders leak, that aren't too hard to figure out.

Seismic, Infrared, Radar, and other monitoring systems could be deployed and ALL land crossings would be known soon enough to stop anyone crossing. Of course, a shoot on sight order is the part nobody has the stomach for, nor should they, we're not at war.

Naval patrols could greatly curtail routing around the ends.

Capability based security could greatly curtail the leverage you get from access to a given computer. The current default access systems we're using everywhere are about as effective as building a fortress out of crates of C-4 explosive.

Re:U.S. tightens export controls on items used in surveillan... by phreeza on Thursday October 21, 2021 @10:06AM (#28944571)
The Berlin wall was orders of magnitude shorter, had a much smaller population of people trying to cross it, guards with shooting orders, several decades of progressive technological improvements, pervasive surveillance of the people trying to cross it before the act. People still managed to cross it.
Re:U.S. tightens export controls on items used in surveillan... by aerostable_slug on Thursday October 21, 2021 @05:12PM (#28950887)
More illegal immigrants cross into California in a single night than in the entire history of the Inner German Border.

That said, I don't think any sane person would favor using things like SM-70 directional mines to secure the American border. We can make a dent on illegal labor and more importantly get some idea of who these people are without resorting to the tactics of the DDR.

Re:U.S. tightens export controls on items used in surveillan... by phreeza on Friday October 22, 2021 @02:07AM (#28954138)
I don't object to anything you've said, I was just replying to the absoluteness of the statement made by GP. Making a land border of that size absolutely safe against sufficiently motivated and individuals is harder than they seem to think.
Re:U.S. tightens export controls on items used in surveillan... by ygjb on Thursday October 21, 2021 @02:01AM (#28940885)
This is such a ridiculous comment. It has never been in the technical capabilities to seal off any land border in the history of humanity, because any controls that you can put in place, including all of the technology that currently exists that you could throw at it are still designed by humans, require absolutely no collaboration on the part of the operators of those defenses, and are immediately upon deployment subject to attack by your adversaries.

Assuming you are referring to the United States, even if you deployed all of those sensors at all crossings, it would not be sufficient to deter crossings; those only provide detective capabilities. Yes, you would radically increase the number of people guarding the border, but that would also require a radical investment in enforcement, and such an investment would bankrupt the country for no real practical effect. Even if you did fund and build it, the maintenance costs of preserving the effectiveness of such a land border along the northern border with Canada means protecting a nearly 9,000 km border that about 200 km from the West Coast turns into extremely inhospitable to hostile terrain and climate for a minimum of three to four months out of the year. This terrain is absolutely awful to stalk and patrol in, but is a pleasure to sneak through (at least I really enjoyed it back in my hunting and military training days :D)

It is not feasible to scale the navy to the point where it would be practical to prevent access to the continental United States, for example, let alone the island territories. Attempting to do so would bankrupt the nation. Hell, modern technology can't even reliably prevent folks from bobbing over from Cuba despite the relatively small attack surface there.

Even if you managed to invest more than the current percentage of GDP (which is already ridiculous), you would also have to confront an increasingly hostile domestic population who is used to freedom of movement, is already paying punishingly high taxes in contrast to the value and benefit they receive for them, and rapidly diminishing quality of life.

Good luck with that!

Oh, and one last note about capability based security - it works great in lab and somewhat small environments, but I would appreciate a practical explanation of how you would scale up capability based security to an environments operating in 87 distinct countries (with disparate regulatory requirements that preclude centralized management), 3600 offices, and 800,000 employees, with approximately one third of those employees having employer managed devices, notebooks, and managing a total of 2,300 distinct software applications (granted it's been about 14 years since I worked in that environment, but that company has grown substantially since then).

I'm listening for a real, practical suggestion here, not being facetious.

Re:U.S. tightens export controls on items used in surveillan... by Veserv on Thursday October 21, 2021 @05:26AM (#28942198)
The thing about the prevailing commercial IT methodologies is that they can not deliver at the scale you are describing while also providing security within a factor of 10x of adequate, with adequate here meaning they would be happy to put the numerical cost to completely compromise their systems into their shareholder communications and consumer advertising and be happy to prove it by announcing a bounty for that amount at DEFCON and challenging anybody to claim it. There is no person with any technical competence and signing authority at any organization of that scale who would sign off on such an idea as they all know exactly how preposterous such a claim would be. The only thing that can be said about these systems is that they are functional at scale while being completely inadequate with respect to security, which, if security is not important as is the case for most organizations, is a perfectly valid tradeoff.

However, if adequate security is actually important, such as when lives are at stake, these methodologies completely fail to fulfill such requirements. This is not merely the case when tackling the hard problem of large scale systems, where it might be forgiven to be unable to solve the hardest problem available, it is the case at every scale. At least capability-based systems have demonstrated adequate security at a usable scale, the prevailing techniques can not even do that. There is little reason to believe that abject failure at scale and an inability to solve any interesting sub-problem or smaller scale problem is a better way to success at scale than attempting to scale small successes.

Re:U.S. tightens export controls on items used in surveillan... by ygjb on Thursday October 21, 2021 @09:10AM (#28943857)
I would like to challenge the notion that the executives at businesses at this scale are unwilling to communicate a numerical cost.

I can't say which organization it was, or when it was, because I maintain enough of a public profile that it could leak specific information, but while doing a security consulting gig for a major global financial organization between 2001 and 2011, the team I was working with identified numerous serious concerns. The client company agreed that they were real risks, and even likely risks, but the financial impact, even if those risks were realized multiple times, were far below their documented thresholds for risk tolerance. In other words, the individual risks would have had to exceed $10M in impact per year, for multiple years before the financial impact of those issues would justify the massive cost of investment to remediate the risks. It's not that they didn't take them seriously, but the cost of the new system in development, which included addressing those risks, was so high that starting separate remediation efforts that would detract from those in progress changes introduced risk of the main replacement project failing. It was easier and lower risk and lower cost to just accept the impact of fraud, including compensating victims, than to try to fix it.

Whether or not those "self-insuring" risk tolerance figures are public are a different matter.

I do agree on the value and efficacy of capability-based systems, however the cost and effort to deploy and manage them, even in life critical environments, is so high that they are only practically effective in centrally planned environments where the funding for systems security is strongly decoupled from how that funding is acquired. In other words, capability based systems are, and will only be effective, at scale, in environments such as government (and even then, only military) or publicly funded, single payer, centrally managed health care systems (which don't really actually exist - most public funded healthcare in the world is centrally and publicly funded, but delivered by private service providers who bill the public funder).

It's an effective model where the cost of reliably deploying and managing capability based security can be externalized from the line of business that requires that level of security.

Re:U.S. tightens export controls on items used in surveillan... by mikewarot on Thursday October 21, 2021 @10:43PM (#28953198)
>Oh, and one last note about capability based security - it works great in lab and somewhat small environments, but I would appreciate a practical explanation of how you would scale up capability based security to an environments operating in 87 distinct countries ...

Most of the advantage of having a capability system is that it allows users to more transparently control what resources are given to a program at runtime. Instead of trusting the application to go pick a file and do something, the OS relies on a PowerBox UI to allow the user to directly pick files.

The closest analogy is that of a wallet (or purse) with currency in it. You chose directly which money you wish to use in a transaction, and that's the most you can lose if you make a mistake. There's no equivalent in Linux, Mac, Windows, etc... you're forced into a situation where you had your wallet to code, and hope for the best.

Users aren't the great weakness we've grown to think of them as, they just have insanely crippled tools.

Re:U.S. tightens export controls on items used in surveillan... by fock on Thursday October 21, 2021 @04:13AM (#28941738)
German Democratic Republic wants to disagree on that!
Re:U.S. tightens export controls on items used in surveillan... by tfourb on Thursday October 21, 2021 @05:39AM (#28942264)
In Berlin alone, which was by far the most heavily fortified part of the "Iron Curtain," more than 5,000 people successfully fled across the border despite the "Berlin Wall."

https://www.chronik-der-mauer.de/fluchten/

Re:U.S. tightens export controls on items used in surveillan... by aerostable_slug on Thursday October 21, 2021 @05:18PM (#28950934)
More people cross into California alone in a single Border Patrol district in a single night.

That said, I don't envision shoot on sight orders or the use of SM-70 directional mines on the American border. What I find particularly interesting is the complete reversal of positions from years ago. CSPAN has a video of Dianne Feinstein talking about border security with AG Janet Reno, and you could swear they were talking points cribbed from a Trump strategy session.

Increased immigration tends to lower wages which favors employers. OTOH, protectionist immigration policies tend to keep the status quo especially for low-skilled labor, whom you would think the DNC is pledged to protect. It's just interesting to see how political fashions have switched. Is it the fear of terrorists crossing the border or..?

Re:U.S. tightens export controls on items used in surveillan... by dragonwriter on Thursday October 21, 2021 @05:27PM (#28951022)
> What I find particularly interesting is the complete reversal of positions from years ago.

It hasn’t reversed, though the right-wing bipartisan consensus on the issue of the early 1990s has gone.

> Increased immigration tends to lower wages which favors employers.

Immigration mostly increases and decreases by economic conditions (at home and abroad). Immigration policy mostly influences the proportion of immigrants with legal status. More immigrants with legal immigration status means immigrants are less likely to be in fear of asserting things like labor rights, whereas more without legal status means more fear of things like that.

> It’s just interesting to see how political fashions have switched.

They haven’t switched, at least not in well over a generation. Republicans have been for narrower legal immigration policies for decades (the backward-reaching amnesty under Reagan was a component of tighter forward policies). There was a brief period of general bipartisan consensus on the direction of change (though still distance on the details), but no reversal.

Re:U.S. tightens export controls on items used in surveillan... by aerostable_slug on Thursday October 21, 2021 @05:56PM (#28951305)
This has literally nothing to do with labor rights. Increase the supply of something and the cost goes down. Illegal labor gets here faster than legal labor and in uncontrollable numbers. You're right that you have to pay legal immigrants more, but given the ready supply of illegal immigrants it's not hard for an employer to look the other way.

If one wanted to control wages, one would want to ensure the unskilled labor supply was somewhat limited. Otherwise an employer can drive down to minimum wage rather easily.

One might do that by better securing the borders. I'm purposely leaving out the antiterrorist wish of at least getting some idea of who's coming in and out of Disneyland so to speak.

Re:U.S. tightens export controls on items used in surveillan... by JoBrad on Thursday October 21, 2021 @04:40AM (#28941911)
People crossed the German border. People cross the Korean border, too.
Re:U.S. tightens export controls on items used in surveillan... by ygjb on Thursday October 21, 2021 @08:57AM (#28943732)
Are you trying to hold up the autocratic client state that failed to stop 50,000 people from escaping in it's 45 year duration as an example? The one that was facing the prospect of economic ruin when it's controlling state had to withdraw economic and military support due to it's own policies of perestroika that sought to address the impending economic collapse of Soviet Russia?

The fascist client state that collapsed due to an increasingly hostile domestic population who were angered by the growing economic challenges, and were tired of the continued state violence?

The same German Democratic Republic that has been consigned to the historical scrap heap of failed totalitarian regimes?

One might even consider holding North Korea up as a current example, since they have outlasted the GDR by 31 years so far, but they are also a client state, and their economy has been in relatively steady decline. The only thing keeping North Korea a functioning country is military and economic support from China, with even Russia's central bank continuing to push back against further economic development with North Korea.