Subject: [Trans] binary transparency

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Dec 2015 15:43:01 +0000

When/if this WG do get to address binary transparency,
which I hope we do, then this [1] could be a nice case
study in how that could be useful to the world.

Cheers,
S.

[1] https://www.imperialviolet.org/2015/12/19/juniper.html

---

From: Paul Wouters <[email-masked]>
Date: Tue, 22 Dec 2015 11:17:29 -0500 (EST)

> study in how that could be useful to the world.

Unfortunately, Juniper released these images themselves as valid signed
images. So they would all just get a pass from any transparency system.

Paul

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 22 Dec 2015 16:27:29 +0000

> images. So they would all just get a pass from any transparency system.

Right, but in the presence of a binary transparency
system, (that involved publishing the binary as well),
injecting attack code would presumably be a less
attractive attack as that could be spotted by the
unwashed public as a result.

Cheers,
S.

> 
> Paul
> 
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>

---

From: Paul Wouters <[email-masked]>
Date: Tue, 22 Dec 2015 11:36:02 -0500 (EST)

> unwashed public as a result.

But juniper already published their binary firemware for everyone to
download and diff/analyse. No one spotted the changes when they were
made. Now people are spotting the changes because compared to the previous
firmware, it are the _only_ changes in the binary.

Now if these firmware binaries had only been distributed to one particular
region or set of IP addresses, then yes, a binary logging system would
have detected these.

Paul