From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: <941cc240e9368544f7edceaee74294f4@9srv.net> References: <941cc240e9368544f7edceaee74294f4@9srv.net> Date: Mon, 25 Feb 2013 19:49:36 +1100 Message-ID: From: Bruce Ellis To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net> Content-Type: multipart/alternative; boundary=089e010d867ae5345b04d6889e26 Subject: Re: [9fans] What's up with $home? And a security question. Topicbox-Message-UUID: 1eacd042-ead8-11e9-9d60-3106f5b1d025 --089e010d867ae5345b04d6889e26 Content-Type: text/plain; charset=UTF-8 if you can't trust a cpu server don't use it. applies to carbon based life-forms too. On 25 February 2013 00:29, wrote: > Cinap mostly covered this, but yeah: if you don't trust the > system you're connecting to, cpu isn't really safe[1]. But > then, neither is anything else: even the simplest service > (say, telnet) can be trivially bugged with things like key > loggers if the remote side's untrustworthy. > > If you've not read it, you (and everyone else in CS) should > read "Reflections on Trusting"[1], by Ken Thompson, > describing how he bugged the login program and then > made it roughly undetectable. Things like cpu's -P can > help in a sense, but at some point it comes down to > trusting the humans on the remote end. > > [1] http://cm.bell-labs.com/who/ken/trust.html > > > --089e010d867ae5345b04d6889e26 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
if you can't trust a cpu server don't use it. appl= ies to carbon based life-forms too.

On 25 February 2013 00:29, &= lt;a@9srv.net> wrote:
Cinap mostly covered this, but yeah: if you = don't trust the
system you're connecting to, cpu isn't really safe[1]. But
then, neither is anything else: even the simplest service
(say, telnet) can be trivially bugged with things like key
loggers if the remote side's untrustworthy.

If you've not read it, you (and everyone else in CS) should
read "Reflections on Trusting"[1], by Ken Thompson,
describing how he bugged the login program and then
made it roughly undetectable. Things like cpu's -P can
help in a sense, but at some point it comes down to
trusting the humans on the remote end.

[1] =C2=A0 =C2=A0 http://cm.bell-labs.com/who/ken/trust.html



--089e010d867ae5345b04d6889e26--