Hacker News new | past | comments | ask | show | jobs | submit login

I think you're stretching the definition (at least at a conceptual level) of "Air-Gapped" when your means of communication are connections that go through the air-gap.

I guess there are probably real systems referred to as "air-gapped" that don't have power isolation they could be addressing, but it still feels a little disingenuous.




It just goes to show that "sufficient paranoia" is something that should be evaluated relative to the value you are protecting and the estimated potential strength and persistence of adversaries.

Security measures (should be) a line item on a budget with a total. The details are something that might be reviewed by an expert in the field with the necessary clearance. Secrecy also has a cost (security by obscurity isn't a design feature, but security //plus// obscurity might have a worthwhile value).

I think at a site level a sufficiently sized dynamo, maybe per section, could be utilized as both an initial gaping measure and as a mux for different power sources (line, stopgap, and local generation). For high value sections one or more full re-regulation stages would help. (Off the shelf, a UPS that always AC > DC > AC converts comes to mind.)

Finally, at an OS level, it seems that the highest value targets should probably examine a feature similar to the 'constant time' style cryptographic / security response paths better algorithms and designs have; in this case always running the system within a constant performance (and power use) envelope. I had not previously considered that such ultra-high security environments might be harmed by /efficiency/ as a means of leaking data.


The last few years of research have driven the point home [1] that 'air-gapping' is to be interpreted in a quantum sense -- within the domain of information theory and physical observability -- instead of merely not punching any formal hardware interfaces through.

Whether your threat model actually needs to protect against these is an entire other question.

[1] https://news.ycombinator.com/item?id=12273582


Quite a few sites have air-gapped networks that consist of employees having two computers (on the same desk), one in the secure network, and one connected to outside. Obviously there's no power isolation.


They are actually on separate power networks (red and black) at least the ones I’m familiar with.

There is also a minimum distance between the computers that must be adhered, in fact there is a minimum distance and shielding requirements for the in wall cabling between different networks including power.

And my guess is that since 2009ish the regulation have only become more strict.


I would agree with your assessment. If it's connected to _something_, then it's not air-gapped, right? I've never built an air-gapped system before but I imagine that I would want to start with a room lined with copper mesh and a big battery bank.


Outside of a military context (and often even there too) air-gaps don't mean nearly as much as programmers think they do. There are too many possible ways in / out.


A pretty robust secure room even from many decades ago would combine isolation tricks you would see in various single-purpose laboratory settings and in hollywood movies.

A room within a room with non-parallel walls for acoustic isolation over a wide frequency range. The inner room is hanging from a spring suspension system. A mesh layer for electromagnetic shielding. A power isolation system doing some elaborate AC-DC-AC conversion (mechanically and/or electrically). Also, separate air handling systems to avoid connected duct work.

And of course, there could be significant buffering and filtering via mass loading, shock absorbers, capacitor banks, chilled water tanks, etc.


Perhaps we should start going with vacuum gapping ;)


Yes! We have to rule out the acoustic factor entirely. Better put big graphite blocks around it too for good measure.


I'll take it a step further and suggest that highly secure applications should be causality gapped - the system is only activated when more than 5 billion light years from Earth, so no data could make it back before the sun destroys the planet.

For critical applications, the system should be launched far enough from the edge of all observable matter, that it is causality gapped to the heat death of the universe.


Your suggestions might be vulnerable to wormholes and other “shortcuts” across spacetime.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: