From mboxrd@z Thu Jan  1 00:00:00 1970
MIME-Version: 1.0
In-Reply-To: <7d3530220908061701t314fdc42i7bce59ad9ba7df9e@mail.gmail.com>
References: <200908051920.10243.corey@bitworthy.net>
	<200908060052.55018.corey@bitworthy.net>
	<6a3ae47e0908060119s431551e1ge53d11bf0b2e477a@mail.gmail.com>
	<200908061628.14132.corey@bitworthy.net>
	<7d3530220908061701t314fdc42i7bce59ad9ba7df9e@mail.gmail.com>
Date: Thu,  6 Aug 2009 17:14:48 -0700
Message-ID: <13426df10908061714h66c0194h210fd6910fdc4bcb@mail.gmail.com>
From: ron minnich <rminnich@gmail.com>
To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [9fans] a few Q's regarding cpu/auth server
Topicbox-Message-UUID: 3afa335a-ead5-11e9-9d60-3106f5b1d025

Short form:

on today's machines, if someone gets physical access, you're owned.
Not much more to say except that with the kind of features vendors
insist on embedding in the systems, you can easily be owned without
physical access -- see the recent Black Hat articles, and I'm not
naming names so I don't get fired. If the colo is doing their job, and
they'd better be!, then physical access is not an issue because it
won't happen, or, when it does happen, the people are trusted and
won't mess with your box.

9grid.net has been at, first, UNM computing center for 2 years and,
second, at LBL for 2 years. In all the time, there have been no
issues. The people at those places are trusted.

If colo staff can't own it by physical access then you've solved a
hard problem and might want to start selling it. In that case, you
need hardly worry about trusting your colo, so put it there anyway.

Screensaver + password seems rather quaint in light of these realities.

ron