Re: German state gov. dicthing Windows for Linux, 30k workers migrating.

On 4/7/2024 3:00 PM, Joe Gwinn wrote:

My instinct is that this second method will likely emerge in some
form, but with larger lumps.  Lets say there were twenty totally
independent implementations (think N-version programming) of each of
the partitions, and there were five such partitions.  One can arrange
things such that it almost never happens the flaws of all the
partitions line up enough to be useful, and with different large
systems using a random set of partitions, the damage will be
contained.

That doesn't work.  Because machines (and their users) WANT to interact with
other machines and other users.
So, they have standardized protocols, tools, applications, etc.
Are you going to stop using file-sharing protocols (because you need
a server/client to implement those -- on each host)?
<https://nordvpn.com/blog/smb-vulnerability/>
Stop browsing/serving web pages?  Resort to a "text only" email MUA/MTA?
<https://www.comparitech.com/blog/information-security/web-browser-attacks/>
<https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/>
<https://portswigger.net/web-security/host-header/exploiting>
<https://www.forbes.com/sites/daveywinder/2023/03/16/microsoft-outlook-warning-critical-new-email-exploit-triggers-automatically-update-now/>
<https://www.forbes.com/sites/daveywinder/2022/08/04/gmail-warning-as-new-attack-bypasses-passwords--2fa-to-read-all-email/?sh=2b2b49054128>
Stop using MSOffice documents?  PDFs?
<https://www.bleepingcomputer.com/news/security/new-microsoft-office-zero-day-used-in-attacks-to-execute-powershell/>
<https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-behind-attacks/>
Hard-code IP addresses (and rely on them to be invariant)?
<https://bluecatnetworks.com/blog/four-major-dns-attack-types-and-how-to-mitigate-them/>
Stop using standard comm protocols?
<https://securityintelligence.com/x-force/dissecting-exploiting-tcp-ip-rce-vulnerability-evilesp/>
<https://www.usenix.org/conference/usenixsecurity18/presentation/chen-weiteng>
People want machines to make things EASIER to share, not harder.  If
you didn't want to "share", then you could adopt a completely proprietary
solution to each of the mainstream issues that are routinely addressed
by COTS products.
And, this doesn't even begin to address "human engineering" exploits!