Skip to Content.
Sympa Menu

bluesky - Re: idealised properties?

bluesky AT lists.ibiblio.org

Subject: Global-Scale Distributed Storage Systems

List archive

Chronological Thread  
  • From: hal AT finney.org
  • To: bluesky AT franklin.oit.unc.edu
  • Subject: Re: idealised properties?
  • Date: Thu, 22 Feb 2001 11:38:46 -0800


Graydon wrote:
> the discussions I've seen focus on 3 categories of threat model:
>
> * incompetence, misconfiguration, congestion, accidental deletion,
> disconnection
>
> * un-coordinated attack by disagreeable people: script kiddies,
> lawyers with small-ish clients, ex-roommates
>
> * systemic attack by global organizations with arbitrary resources.

I agree that the third attack model, as written, is so broad as to make
any resistance impossible. At the extreme the organizations can simply
kill every man, woman and child on earth and their problem is solved.
Clearly this formulation is not a useful way to proceed.

I would suggest an intermediate model, although it is hard to define
precisely. Basically it is a constrained version of number three, where
the attack is limited by political considerations.

In other words, "arbitrary" resources are not available. There are a
variety of constraints that we have discussed.

- Attackers who are unable to interfere with systems in certain political
jurisdictions, and unable to prevent communication with those
jurisdictions.

- Attackers who are constrained by legislative protections on freedom of
speech and who are unable to interfere with encrypted communications.

- Copyright-protecting attackers who are constrained by the U.S. DMCA
which provides certain safe harbors for communication.

- Cost-based attackers who are unwilling to legally pursue individual
users but who will go after vulnerable points where large numbers of
users can be shut down at once.

I didn't come up with these threat models purely by considering what
attackers might do. Rather, I took various features of existing and
proposed systems and looked at the kinds of attacks these systems are
vulnerable to, or are designed to resist. In other words, I inferred
the threat model from the characteristics of the system. This may seem
like a backwards way to go about it, but given the complexity of the
real world situation, I think it is a useful guide to what is possible
and what is not.

Hal




Archive powered by MHonArc 2.6.24.

Top of Page