Comment by mlinksva | Hacker News Reader

Comment by mlinksva | Hacker News Reader

Parent Full thread

Interesting. I presume harder to tamper with (due to CC) attestation wouldn't help if the developer were compromised/had ill intent/wrote an exploitable bug, while sandboxing or other confinement might (depending on the malware/exploit, and coarseness/robustness of the confinement), so they are complements?

(I'm not sure whether SolarWinds involved any malware or unintended vulnerabilities, from my casual reading it seems to have been a bunch of different attacks...in any case, these supply chain attacks/vulnerabilities exist whether they were used in SW or not...I'm just always slightly uncertain by what is meant by SW-style; not a criticsm of this comment, just laying out my ignorance!)

Re memory-safe compilers, is Graal the known one because it is (I guess it must be given the claim) pure Java? As opposed to relying on eg LLVM or GCC which are heaps of C and C++.

Re: Graal, yes exactly.

Yes attestation has to attest to the execution of a program and there's no program that can tell you the developer was competent/honest/not compromised. But what it can do is, for example, tell you that a build was done in a clean and verified environment i.e. one free of attackers/malware. And importantly this guarantee can be made also considering the cloud vendor as an attacker. Think about how horrific it'd be if an attacker got privileged access to AWS or GitHub Actions, for example.

Indeed, thanks for explaining.

Oh, and your mention of Graal reminds me of reading here 56 days ago that it has some support (JavaScript-only at that time) for sandboxing itsself https://news.ycombinator.com/item?id=37572536 presumably not nearly as fine-grained as capability-based schemes mentioned in the OP, but still a useful step perhaps.

It's actually usable as a capability system. You can just run code in a context without permissions and then pass in cap objects that are exposed to that context.

>One solution for that is to use memory-safe compilers but the only one I know of is Graal.

The Rust compiler is another (being written in Rust).

Thanks. I thought the Rust backend was still LLVM.

It is LLVM.

Reply on news.ycombinator.com