Display:
Effective security depends on surveillance and secrecy, on learning as much as possible about the enemy while permitting the enemy to learn as little as possible about oneself.  The requirements of security are in direct and inescapable conflict with the requirements of a free and democratic society.
Software security shows that this is not the case. The open source community uncovers, diagnoses and repairs security vulnerabilities much, much faster than proprietary companies.

guaranteed to evoke a violent reaction from police is to challenge their right to "define the situation." --- David Graeber citing Marc Cooper
by Migeru (migeru at eurotrib dot com) on Thu May 25th, 2006 at 05:43:14 AM EST
The applicability of your example might depend on what "effective" security means.  On one hand. On the other hand, on how you mean open source community - I know you're a Wikipedian, so if you mean that, I don't know the security issues involved, however, security with Linux does involve secrecy quite naturally - not secret source codes but limited file access on computers running Linux, firewalls.

*Lunatic*, n.
One whose delusions are out of fashion.
by DoDo on Thu May 25th, 2006 at 10:31:50 AM EST
[ Parent ]
Effective security of industrial operations means that you cannot just randomly come in and wander within the facility, and touch whatever you damn well please. Effective computer security involves restricting read/write/execute access to every file on the computer, and the ability to close communication ports. But if the source code of everything is public it means everyone knows how everything works.

guaranteed to evoke a violent reaction from police is to challenge their right to "define the situation." --- David Graeber citing Marc Cooper
by Migeru (migeru at eurotrib dot com) on Thu May 25th, 2006 at 10:36:17 AM EST
[ Parent ]
OK. First on your general vision of a nuclear plant security open source community. It is compelling, and would certainly mean an improvement upon today, but it fits my original argument about secrecy as necessary characteristic of nuclear power. You do include a security perimeter, and consequently a line behind which outsider's measurements can be barred and inside which files can be kept. Those that make such decisions aren't the system operators, for whom information exchange about system vulnerabilities is a two-way street, peer-to-peer; but people who have to care about balance sheets (where I note that addressing security problems can cost a lot more than changing computer code), public reactions, and the continuation of projects: the equivalents of CEOs and administrators hiding company/state secrets on servers running Linux. This is cause for concern in case of chemical plants, but the stakes are higher and outside control is qualitatively more difficult for nuclear.

Regarding effective security, even with your definition focussed on human access, I don't think current open source community standards are sufficient [with which, note, I didn't meant they couldn't be an improvement]. The worst case scenario with a system vulnerability for a Linux OS would be a few ten thousand computer crashes, which the sysadmins have to repair by debugging, running a different Linux version, or getting a patch through another internet-connected computer. Addressing system vulnerabilities includes ticking your own system. In case of nuclear facilities, the equivalent worst case scenario should be better avoided. (Staying with the mischievous human factor, you needen't think of al-Qaida. In the USA in the first half of the eighties, there has been a case of sabotage of safety pumps and two cases of sabotage of back-up diesel generators by insiders, and one sabotage of external power lines.) Meanwhile, ticking your own system can be done only in a limited way, you have to rely on simulations and assumptions.

*Lunatic*, n.
One whose delusions are out of fashion.

by DoDo on Fri May 26th, 2006 at 01:05:27 PM EST
[ Parent ]
I do include a "security perimeter". You do lock your door at home, don't you? And the office where you work is not 100% accessible to the public, is it? And it gets locked at night. Your computer's security is "a line behind which files can be kept". I don't know what it is that makes any of this evil. Since nuclear power plants (and chemical plants) involve a risk to the public health, they are subject to government regulation and audit. Everyone and every activity is similarly subject to regulation and audit because it impacts society in one way or another. But there is no requirement to keep everything in display for everyone to see.

Why is outside control qualitatively more difficult for nuclear?

guaranteed to evoke a violent reaction from police is to challenge their right to "define the situation." --- David Graeber citing Marc Cooper

by Migeru (migeru at eurotrib dot com) on Fri May 26th, 2006 at 03:16:52 PM EST
[ Parent ]
In other words, limited access but public protocols.

guaranteed to evoke a violent reaction from police is to challenge their right to "define the situation." --- David Graeber citing Marc Cooper
by Migeru (migeru at eurotrib dot com) on Thu May 25th, 2006 at 10:37:08 AM EST
[ Parent ]

Display:
Login
. Make a new account
. Reset password
Occasional Series