Re: Ada Operating System

[James Ross <rem.jr@rem.webross.com>]

On Tue, 26 Mar 2002 13:01:44 -0500, "Marin David Condic"
<dont.bother.mcondic.auntie.spam@[acm.org> wrote:

>There would obviously be a need to make sure that the process by which this
>was done would not be so simple as to let it happen accidentally, nor should
>it be allowed without some confirmation that the person doing it was
>actually allowed to do so. Hence the notion of a "Secret Handshake".

I agree that such a "shoot yourself in the foot" mode should be a big
inconvenience or you would have people using that mode to solve common
problems.  I.e. logging in as root on UNIX to do the stuff you have to
do. This mode should be for disaster recovery only and avoided
completely under any other conditions.  A version of the OS could be
compiled specifically for developing the OS itself that could switch
easily between the modes **IF** that were necessary, I am not to sure
that it would be.

One idea that came to mind is that during an install by the Admin a
key would be given to him.  Something equivalent of an OEM key for a
MS product. (aren't those a pain?).  Only on a cold reboot and with
that key would he be able to enter the unsafe mode.  That key would be
stored on the system encrypted using industrial strength encryption to
make it very difficult for hackers to break it even if they did get
passed the other security protecting where it is stored.

>Clearly if this, as yet hypothetical OS, were to be produced and made
>available in source code, someone would find any back doors & make them
>known. That actually brings up another problem: Assuming you were billing
>the system as "secure" by some definition, how would you be sure that any
>given distribution *didn't* include a back door? That would be one heck of
>an audit process, eh? :-)

You could come up with an Open Source License that stipulated that you
can use it for free but you can't publicly distribute it.  Also, any
changes made to the OS code base must be given back to the project.
Then maintain a single distribution point of releases.  Anyone wanting
to make sure they got the "secure" version would then make sure they
got it from that single distributor. This would definitely avoid the
distribution plethora like you have with Linux. 
JR

>
>MDC