|
|
Log in / Subscribe / Register

Security quotes of the week

By contrast, Ironic has the problem that the user can now modify any aspect of the machine as if you gave them physical access to it. In most cases, that’s not desirable, and in public clouds it’s a fun way to let the NSA (and other agencies) install firmware for your users to enjoy later.

NSA-as-a-Service does have a certain ring to it though.

Mark Shuttleworth

That's all it takes to take down a company and stop their human rights abuses. That's the beauty and asymmetry of hacking: with 100 hours of work, one person can undo years of work by a multi-million dollar company. Hacking gives the underdog a chance to fight and win.

Hacking guides often end with a disclaimer: this information is for educational purposes only, be an ethical hacker, don't attack systems you don't have permission to, etc. I'll say the same, but with a more rebellious conception of "ethical" hacking. Leaking documents, expropriating money from banks, and working to secure the computers of ordinary people is ethical hacking. However, most people that call themselves "ethical hackers" just work to secure those who pay their high consulting fees, who are often those most deserving to be hacked.

— The attacker responsible for the Hacking Team data breach

to post comments

Security quotes of the week

Posted Apr 26, 2016 18:53 UTC (Tue) by davidstrauss (subscriber, #85867) [Link] (4 responses)

What is Ironic? The blog post doesn't have a link, and the name is un-Google-able.

Security quotes of the week

Posted Apr 26, 2016 19:01 UTC (Tue) by rahulsundaram (subscriber, #21946) [Link] (3 responses)

I searched for "Openstack Ironic" and got

https://wiki.openstack.org/wiki/Ironic

Security quotes of the week

Posted Apr 26, 2016 20:42 UTC (Tue) by davidstrauss (subscriber, #85867) [Link] (2 responses)

Thanks, but it wasn't clear from Shuttleworth's post that Ironic was part of OpenStack, especially since it talks about OpenStack and then introduces Ironic "in contrast."

Security quotes of the week

Posted Apr 26, 2016 20:51 UTC (Tue) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

I *think* he is contrasting bare metal provisioning via Ironic vs openstack lxd driver.

Security quotes of the week

Posted Apr 26, 2016 22:10 UTC (Tue) by mjg59 (subscriber, #23239) [Link]

Not quite. Ironic provisions an entire operating system, including kernel - all hardware access is mediated by code under the user's control. LXD allows you to deploy entire userlands, but not the kernel. The argument is that Ironic is dangerous since a malicious user can use direct hardware access to modify components of system firmware such that later users of the same hardware can have their sessions compromised. LXD avoids this by ensuring that there's a trusted kernel blocking any attempts to hack the firmware.


Copyright © 2016, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds