In formal, established companies this does exist: it's called "decision support analysis (or researcher)." Whether a particular staff person is steeped in academic research, which they should, and whether a particular staff person provides actionable insight and intelligence that big companies often lack is another matter. The problem is discoverability of results (because there is a vast universe of unstructured data and research out there) and applying it to specific needs: academic journal search (LexisNexis) and regular search engines combined with talented staff might work.
Sounds like there's a startup or two in decision support anyhow.
For embedded/industrial applications the future is in domain-specific operating systems that are JEOS by virtue of not compling unneeded syscalls. OSes like Linux have way too many ABIs and internal machinery that just aren't necessary for headless systems and merely opens a huge attack surface by default... Even with make menuconfig stripped .config, there's still a ton of extra bells and whistles.
In a positive direction, it would be nice to be able to be able to strip out more functionality and still produce a functional kernel. Unfortunately, I don't think this is scalable with autotools or any configuration management setups without having more #ifdefs than code. Haskell could be a good candidate for such a kernel framework, but I'm sure there are other functional and imperative languages that have better complex configuration mgmt support with formal verification.
Does "ultimatum" and "raft of complicated last-minute changes" not raise anyone else's tinfoil paranoia alarms?
Those commits should get significant scrutiny, because it sounds like US/CA govt were given an indirect opportunity to push whatever changes it wanted AND rushed code isn't necessarily the best either.
- Deploying a financial app through 4 bastion hosts by keeping Russian doll ssh tunnels up (clients outsource IT bouncing across the world to get to the right boxes)
- porting a 8 MLoC fortran nuclear reactor simulator from UNIX to windows
- generating PowerShell on Linux to be run on a windows box by reverse engineering the MS Api.
- silencing dialog boxes by DLLs which patch and proxy system DLLs
- making Java JRE run from a CD-ROM with the right JNI dll/so and a custom installer I wrote, before the advent of installanywhere (talking Java 1.1 days)
Ah yes exactly. The "prove them wrong" part, it's important not to attack the accuser but demonstrate that their claims don't hold up. Also if there is something to claims, admit it quickly (kills the story) and show enacting preventative measures.
Looking for something that's 1:N anonymously without a viewer plugin... has a page somewhere that shows a live feed: vimeo, ustream or YT but free to stream.
Right now, researchers are putting together functional brain structure maps combining fMRI, SPECT and PET scans for Alzheimer's research. Apart from the inconvenience of wearing a giant magnet, pulling together one or more brain scan techs with compute resources might be a way to pull it off. Heck, if the compute power needed were too bulky to be practical, it might be possible to offload it to a hosted service. (Talking a solution 15-18 yrs out anyhow.). It's entirely reasonable that keyboards would be slower than thought input in 50 years.
They're not, never will be. Especially if there were a concerted effort to put together a GNU/Linux like open source hardware stack to get rid of the fear, uncertainty and doubt of what's inside commercial processors and chipsets. Also there needs to be more decapping of commercial chips to see what's actually in them.
Sounds good because it suggests sec industry disengagement. Probably simpler to do that and maintain it as a set of minimal patches to LibreSSL, because not many people need it. Either way, it should be secure by default.
I guess it begs the question (FIPS mode seems to fail the "talk to a cryptographer rule"): why don't/aren't sec folks more involved to assure standards are meaningful? Was this a NIST-driven process or was it open to public comments?
FIPS mode is like a clipboard audit. It appears to fulfill a requirement like A+ certifications do for hiring qualified candidates, but instead puts blind faith in process ahead of content.
The problem is that being abrasive without displaying a clear, correct opinion won't lead to greater influence. The latter stance is the important bit.
Security projects need adversarial discussions to keep them honest, but that's a special case.