That's the gist of it.
If you think this is interesting I can highly recommend you check out Sigsum - our transparency log design for signed checksums. We've been developing it for a few years and will most likely toggle it version 1 this spring. Here's its threat model:
Sigsum is designed to be secure against a powerful attacker that controls:
- The signer’s secret key and infrastructure - The log’s secret key and infrastructure - A threshold of so-called witnesses that cosign the log
Another project that started at Mullvad VPN and is now its own company is Tillitis. Its first product is an open source hardware USB device with unconditional measured boot and key derivation inspired by DICE. Everything from source code to Verilog and KiCad files are on GitHub. Enjoy!
Cheers, Fredrik Stromberg
(Disclosure: I cofounded Mullvad VPN, invented System Transparency, co-designed Sigsum, co-designed TKey, and cofounded Tillitis)
That said, solving a trusted boot problem was not something I could tackle alone. I didn't have a sense for how much/little I could trust the machine/bios/firmware. None of the tooling I considered (hashing firmware/boot data/etc.) seemed secure without a whole additional infrastructure.
I'm thrilled to see this implemented though.
[1] modern version here: https://github.com/joelandman/nyble
It makes me curious if there are any other real-world use cases for diskless. Are there any customers who would benefit from such a configuration from major cloud providers? E.g. a diskless EC2 instance type that ran off of a RAM disk?
OVPN[1] (Swedish jurisdiction) have been diskless[2] since day one, and this has been tested and proven in court[3]:
"To summarize the verdict, the Rights Alliance and their security experts have not been able prove any weaknesses in OVPN's systems that could mean that logs are stored. OVPN therefore wins the information injunction as our statements and evidence regarding our no log VPN policy have not been disproven. The movie companies also need to pay OVPN's legal fees which amounts to 108 000 SEK (roughly $12300 at current exchange rate)."
[1]https://www.ovpn.com [2]https://www.ovpn.com/en/security [3]https://www.ovpn.com/en/blog/ovpn-wins-court-order
As an example, X Terminals all worked this way. Much of the old Sun Microsystems "The Network Is The Computer" pitch was having low-end, diskless SPARC machines (e.g. SLC, ELC) netbooting and mounting disk and doing heavy lift compute via NFS & X11 from large SPARC servers and storage arrays.
You can look at the Linux Terminal Server Project (ltsp.org) for some reasonably current ideas of what someone might do with this.
Simple example - thin client that boots off readonly NFS and just mounts user dir when they log in. Or one step further and have image with remote desktop software and nothing else.
More complex one - storage server that boots over network so you don't have to manage any OS install on disks and can use full capacity of drives for storage
Nowadays you could use similar approach to run cluster for in-memory compute tasks or similar. PXE boot identical OS to bunch of servers and have them compute sth. If you need to repurpose them for something else - reboot them into a different PXE boot image. In case of VPN providers the motivation is probably to prevent (permanent) logging of sensitive information.
Not clear what 'diskless' means in this situation anyway.
For small uses, I would think tmpfs would be fine. And I would personally tend to think that non-small data probably shouldn't be local anyways (because most data should live in a central database and/or on a SAN or ceph or whatever). Obviously it depends on your exact usecase, but usually.
Submitted URL was https://mullvad.net/en/blog/2022/12/30/review-of-2022/, which is a list, and that item looks like the most interesting thing on this list. (see https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor... for why we do this sometimes)
This generally works well, but I'd say there are about 0-20 blades that crash a day due to some sort of memory corruption issues.
Due to the fact that I was operating remotely from the hardware, I never really got a chance to resolve it... also... just a simple reboot would fix it (and the blades booted in ~60 seconds, so it wasn't a huge issue).
So, on large enough scale... this can be an issue to consider.
I don't know what the threat model is, but if it involves nation states confiscating servers, then diskless is of limited help: https://en.wikipedia.org/wiki/Cold_boot_attack
> If the computer is powered off, moved or confiscated, there is no data to retrieve.
Oh wait...
It provides so many benefits and eases the server management greatly.
Can you elaborate on this? I would have thought that needing local storage cache and the potential for network latency would make PXE untenable.
[1] https://www.amazon.com/Mullvad-VPN-Devices-Protect-Security/...
Those resellers then charge about the same price as Mullvad, but get to keep a piece of that as profit.
However, what makes them great and unique is that they're ideologically motivated, so of course they're not selling shares.
If there's a better URL, we can change it again. I just don't think year-in-review laundry lists make for very good discussion, because inevitably they produce generic referendum-style threads about the company or project.