Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!feeder.news-service.com!newsfeed.xs4all.nl!newsfeed6.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=Sei/xA33IaP7i/QyuA6ABq8ekFD0UEuUv2bcNxVwdCPAA/1vYFrKLFgYaOpZ+3ZsOQ 1JqO5V/y8FRJ0XHhesR23lMFk8se7jAmq0fwEAsRxZb24qX+9+YBinvrCXycmJiv5y5S Oo0ElcQHmkfVz8gdnHox+sv1yVVBucgv5P0Cc=
MIME-Version: 1.0
In-Reply-To: <rgcda8-tor.ln1@svn.schaathun.net>
References: <4DD08620.4030507@tysdomain.com> <mailman.1611.1305512463.9059.python-list@python.org> <op.vvlipenoa8ncjz@gnudebst> <5h9ca8-ekq.ln1@svn.schaathun.net> <mailman.1757.1305737674.9059.python-list@python.org> <rgcda8-tor.ln1@svn.schaathun.net>
Date: Wed, 18 May 2011 12:07:49 -0700
Subject: Re: obviscating python code for distribution
From: geremy condra <debatem1@gmail.com>
To: Hans Georg Schaathun <hg@schaathun.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: python-list@python.org
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.1769.1305745672.9059.python-list@python.org>
Lines: 73
NNTP-Posting-Host: 82.94.164.166
Xref: x330-a1.tempe.blueboxinc.net comp.lang.python:5729

On Wed, May 18, 2011 at 10:33 AM, Hans Georg Schaathun <hg@schaathun.net> w=
rote:
> On Wed, 18 May 2011 09:54:30 -0700, geremy condra
> =A0<debatem1@gmail.com> wrote:
> : =A0On Wed, May 18, 2011 at 12:36 AM, Hans Georg Schaathun <hg@schaathun=
.net> wrote:
> : > But then, nothing is secure in any absolute sense.
> :
> : =A0If you're talking security and not philosophy, there is such a thing
> : =A0as a secure system. As a developer you should aim for it.
>
> You think so? =A0Please name one, and let us know how you know that it
> is secure.

I was playing around with an HSM the other day that had originally
targeted FIPS 140-3 level 5, complete with formal verification models
and active side-channel countermeasures. I'm quite confident that it
was secure in nearly any practical sense.

> : > and thereby provides some level of security.
> :
> : =A0The on-the-ground reality is that it doesn't. Lack of access to the
> : =A0source code has not kept windows or adobe acrobat or flash player
> : =A0secure, and they have large full-time security teams, and as you mig=
ht
> : =A0imagine from the amount of malware floating around targeting those
> : =A0systems there are a lot of people who have these skills in spades.
>
> You are just demonstrating that it does not provide complete security,
> something which I never argued against.

Ah, my mistake- when you said 'some level of security' I read that as
'some meaningful level of security'. If you were arguing that it
provided roughly as much protection to your code as the curtain of air
surrounding you does to your body, then yes- you're correct.

> : > Obviously, if your threat sources are dedicated hackers or maybe MI5,
> : > there is no point bothering with obfuscation, but if your threat sour=
ce
> : > is script kiddies, then it might be quite effective.
> :
> : =A0On the theory that any attack model without an adversary is
> : =A0automatically secure?
>
> No, on the assumption that we were discussing real systems, real
> threats, and practical solutions, rather than models and theory.
> There will always be adversaries, but they have limited means, and
> limited interest in your system. =A0And the limits vary. =A0Any marginal
> control will stave off a few potential attackers who just could not
> be bothered.

Empirically this doesn't appear to be a successful gambit, and from an
attacker's point of view it's pretty easy to see why. When a system
I'm trying to break turns out to have done something stupid like this,
it really just ticks me off, and I know a lot of actual attackers who
think the same way.

> In theory, you can of course talk about absolute security. =A0For
> instance, one can design something like AES=B9, which is secure in
> a very limited, theoretical model. =A0However, to be of any practical
> use, AES must be built into a system, interacting with other systems,
> and the theory and skills to prove that such a system be secure simply
> has not been developed.

This is flatly incorrect.

> Why do you think Common Criteria have not yet specified frameworks
> for the top levels of assurance?

Perhaps because the lower levels of 'assurance' don't seem to provide very =
much.

Geremy Condra