State considered harmful: A proposal for a stateless laptop (2015)

I've started running Tails on my laptop on a daily basis. It's great. https://tails.boum.org/

It runs off a USB stick and presents a pristine system each time you boot. Modifications to the filesystem go on a ramdisk "overlay", which disappears as soon as you power it off.

It does support "encrypted persistent storage", but there is quite fine-grained control over what things are allowed to go in it. In particular, nothing to do with the web browser persists across a reboot unless you go quite far out of your way to make it persist. And each time you boot, you can opt not to unlock the persistent storage if the work you want to do is either liable to get you infected with malware, or just doesn't need any of your persistent data.

Additionally, all of the networking is done over Tor, and the firewall blocks non-Tor traffic, so you can't even miss out Tor by accident. (But if you don't want to use Tor, it's probably not for you, although having used Tor in the past, I was pleasantly surprised how much faster it is now than it was then).

EDIT: And for those who don't know, OP is developer of https://www.qubes-os.org/ which I tried out for a while, and really like the premise of, but found just slightly too inconvenient to use, and I currently prefer Tails.

Qubes has multiple container VMs. All applications run inside a VM, but the I/O is transparently multiplexed into one desktop environment. The window decorations tell you which VM each application is running in. You can copy and paste, and share files, between different VMs, but only where you explicitly want to. You can create VMs to separate data for different purposes (e.g. one just for email, one just for web browsing, and different ones for working on different projects). The VMs can even run different OS's, and there are VMs included by default that route all of their internet over Tor. It is great.

Hi. A lot of interesting and intelligent comments, but I think that on the whole, we've over-complicated the issue.

To explain what I mean, consider a Commodore 64, Apple IIe, or Atari 800, Ti99 4a, or Radio Shack Color Computer, or most home computers from the early 1980's.

None of these computers, NONE OF THEM, had any form of persistent memory (Flash, EEPROM, battery-backed CMOS, CPU persistent memory, etc.) such that when you unplugged the computer and plugged it back in, something, even so much as a single bit was changed.

In other words, you unplug, and you start over with the exact same initial STATE as you did the first day when you unpacked the box.

That is, software, legitimate or malware, CANNOT change the initial power-up state of the computer. CANNOT.

That is STATELESS HARDWARE.

Note that I did not include x86 PC's in my list, because they typically have battery backed up CMOS, and onboard FLASH in newer models. Those things (and places for writeable Firmware) STORE STATE, thus they change the INITIAL power-up state of the computer.

Once a computer can store state between power offs, then you could be dealing with a different machine than you were when it first came out of the box.

When that happens, now you need all kinds of crazy security asserts that whatever is in there is safe. As opposed to simply powering off, and starting fresh, knowing that you are.

It's frustrating that the author is using the word "stateless" because it usually means something different in the context of computer-related topics. Maybe the title of the paper should have been something like "A proposal for an ephemeral-storage laptop" or something along those lines.

This is a particularly appropriate link right now, given that the core idea of "saving data and state is something which should be avoided" is seeing a renaissance in both privacy-focused circles and in privacy-focused regulatory policies. I love the idea that saving state is to be avoided, and I hope to see it implemented with increasing granularity, both on other people's computers (e.g. web services) and locally.

Remotely, a trend away from "You must create an account to view this cat meme, now enter your date of birth and present a working email address which we'll send a message to" is particularly appealing. And with hosted services, particularly paid ones, I'd love to see privacy policies focused on how little data is kept, rather than how much. I keep hoping that the regulatory or legal or insurance environment will change such that sooner or later, companies will view stored user data as a liability more than an asset, and 'zero knowledge' will be a desirable thing.

Locally, as per-application permissions and sandboxing grows stronger, I can picture a class of applications which would be hard-restricted from saving data between sessions (e.g. the browser, a calculator, a scratch-pad app). Or perhaps, "the only data you can save must be XML, in this plaintext file, so that preferences are saved, but nothing else. Qubes (OP's baby) does this already, but I think a dash of this in existing OSes would be a small step towards big security.

As an aside, in my estimation, Joanna Rutkowska is one of the most compelling computational thinkers today. Although her work tends to be at the most elaborate-threat-focused edge of computing security, reading it, it often feels like she's already running "where the ball is going", and I wouldn't be shocked to find that in 20 years, some of the 'whoa, crazy' things from Qubes or this stateless approach are actually regularly used in mainstream computing. I have no particular threat, and no particular need, and I suspect that many of the programs I use regularly wouldn't work there, but there's a part of me that would love to spend more time in Qubes.

I actually would like a stateless computer. A pure functional laptop. It could store state on the cloud as a series of changesets, and each boot would be a "checkout" of the top state. Then as you compute, you make to make new changesets.

It's called a 'terminal'

Interesting! I hadn't seen this work before. Honestly this seems exactly like the kind of service that would get heckled on HN in the classic Dropbox-Show-HN style. So much so that a couple of my friends and I tried to build something like this a few years ago, essentially outsourcing the end-to-end-encrypted transport of sensitive information via a user-friendly service. We thought a user should be able to designate data for transport, and then click a button, and it gets moved off the machine until some conditions are met at a later time (once you're through the border or whatever) when the data gets moved back onto the machine. Super user-friendly and built for plausible deniability. Our effort sort of trailed off into nothingness in the face of so many other random cool project ideas, in that particular way which probably most of you reading this know quite well. Though as much as people like to joke and cajole about this, it's actually a pretty interesting problem and an excellent thought experiment. If you shed your expectations, it'll send you down some pretty cool rabbit holes. PS: We sometimes use "Seems like a great Dropbox Show HN idea" as a kind of funny emphatic for project ideas when they go on the whiteboard.

Of course, even with a truly airgapped computer, people have developed side channel attacks to exfiltrate information by listening to things not generally considered to be part of the "networking" portion of the computer, such as radio signals generated by the operation of the processor.

I think I must be missing something fundamental. As far as I can tell, the core notion is to move all laptop firmware to an external storage device that has a write-protect switch.

How is this better than an external write-protect switch for the firmware on the device itself? Considering my normal patterns of device usage, I'm just going to put the laptop-specific Trusted Stick into each of my laptops and leave it there. In which case I'm not seeing why it should be removable at all.

And regardless, I'm not seeing how a write-protect switch for firmware, whether on a stick or in the device, is actually better for the average user. At some point the computer is going to tell them, "Hey, you need to allow this security upgrade." How do they know when to allow writes?

This was in 2015. Did he ever develop a stateless laptop?

It would be useful to have one. Too many governments want to snoop on your devices at border crossings.

Direct link to the actual content: https://github.com/rootkovska/state_harmful/blob/master/stat...

I can see it now, Dumb terminals for everybody, and administered by the free country of the US of A

Fedora Silverblue - https://silverblue.fedoraproject.org/

Why not use a normal laptop, but enable it to boot from an encrypted partition of an external drive?

Chromebook

I would like a phone/laptop where you can take sexy pictures and be sure they stay on the phone, and be sure they get deleted when you delete them.

Think I can get VC money for this idea?

Sincerely, with rampant hacking by nation state actors and uninspired pragmatism winning ground, I would definitely be interested in an article on "The Nation State considered harmful". Unfortunately that's not what the title was about.

Can't this kinda be achieved with Windows and Windows Server with AD? You login to the server and it downloads the content for the session and when you logout the content is removed from the local computer?

I remember when in school they used to have this, which made logins take forever.