Hacker News Reader

Comment by maltalex | Hacker News Reader

> Indeed, noted security expert Bruce Schneier calls supply-chain security “an insurmountably hard problem.”

Centrally, yes. But supply chain verification & tracking is one thing blockchains are genuinely good at. There are actual blockchain-based products on the market for that.

Imagine a company such as Apple forcing their suppliers to authenticate each production step from raw material to shipped good on a proprietary blockchain. It's certainly doable from a technical standpoint, and Apple's suppliers are probably eager enough not to lose Apple's business to comply.

View on HN

I don't understand how this solves the problem:

- if all links in the supply-chain are properly verifying/tracking components, why can't they send this verif/tracking data to their client's server?

- if they're not making a good-faith effort, what does blockchain solve?

Blockchain is genuinely good at maintaining an immutable, trust-free ledger. It's NOT good at making sure the data that's written to it is true.

It does not, that's why a blockchain on it's own does not solve the problem but in conjunction with other technologies it could. E.g. food - you have to make sure your sensors (Temperature etc) are tamper proof, but you also have to find a way to make it hard to seperate the sensor from the goods. Only then it would make sense to use it as an oracle. Also if you make it hard enough to cheat the sensor at some point it's just easier to cool the goods and transport them accordingly.

Right, so it really doesn't solve anything. It just passes the buck further down.

Blockchain is a solution in search of a problem, here.

>It's NOT good at making sure the data that's written to it is true.

if you can't trust the manufacturer to begin with (as is the alleged case with super micro) then this is totally useless.

Yeah. That’s what the adults were talking about.

We can’t trust the supply chain.

I don't see how this would help here. If you have a nefarious party adding skullduggerous chips to motherboards, they are hardly likely to attest to that on a blockchain.

My point is, just because someone added a verification message to a blockchain, doesn't mean it actually happened in real life - or indeed preclude additional things from happening.

I know from the car industrie, from each car, they know from each part the whole production history. A factory, for example, is certified to produce part "A". The factory has two machines (machine "B" and "C") who could produce part "A". The factory has to produce samples with machine "B". The samples have to pass several test and get approved by all the companys, who produce bigger and bigger parts with part "A" until you get the full car. So maybe a handfull of companys have to say ok to part "A". This can take like a half year or more.

So now is machine "B" certified to produce "A" but not machine "C".

This takes all pretty long and I don't think it's done this way in the electronics world, because there are almost no callbacks. So why bother so much with the supply chain.

And not to forget, the test is just if the part does pass the tolerances in the factory. It does not test, if a guy in the factory does cheat.

Even if the factory checked "everyting" and all the details. Then comes somebody like the NSA and they just grab the package on the transport from the factory to the customer (Cisco).

What does this actually solve? If you are surreptitiously adding chips to a motherboard, you'd just do it between whatever steps are written to the blockchain.

Even if you can totally secure the factory, you can just redirect the parts in shipping. I think "insurmountably hard problem" is a fair description.

That you for bringing for this intriguing idea for discussion!

Supply chain tracking of the sort you describe is excellent for tracking packages and the movement of goods. It's very useful for tracking the inputs to and outputs from a manufacturing process. Perhaps it's just my personal failure to understand your proposal, but this approach seems mainly limited to tracking known and expected inputs. So it might have a hard time detecting some nigh-invisible addition that takes place within an existing stage of manufacture and does not result in any additional attestation.

Can you help me understand? How does a blockchain solve the problem of a fabrication step compromised?

Reply on news.ycombinator.com