Hacker News Reader

Comment by hl5 | Hacker News Reader

Obviously, Perl is the NSA top language choice due to it's built in support for obfuscation and job security.

Sure.

It couldn't be because perl is installed by default on all of the target platforms. Practicality trumps conference talks when there's work to be done, even in the government.

I know it's not the HN norm, but I believe the parent was making a joke

A joke? On my Hacker News?

I can assure you, practicality and job security have no place in the same sentence when discussing government work.

Although you're joking, Perl was invented to make an NSA project easier to develop. That project was first, high-assurance VPN: BLACKER. It was also NSA's attempt to do something secure for once since they lost the argument to INFOSEC co-founder, Roger Schell, where they thought only communications security, not computer security, mattered. They contracted it to TRW who made a lot of secure stuff & government systems in general back then. Larry Walls was a smart, properly-lazy programmer working at TRW who wanted to make irritating parts of his job easier with better tools. The resulting tool, PERL, had much more impact than BLACKER VPN. ;)

Whereas, the NSA's project failed initially because the team couldn't design a security kernel that had great security and acceptable performance. Told NSA they'd have to pick one. Schell told NSA he knew a guy with a design, GEMSOS, with both properties. NSA reluctantly used GEMSOS in BLACKER. The first, highly-secure VPN w/ general-purpose kernel was born. Who knows what the deployment or usability side of it was, though. Classification rules kept them from publishing on it for a decade or so where it then got paywalled. Classification is probably why Larry Walls didn't say much about BLACKER when describing its history. At least ones I read.

http://ieeexplore.ieee.org/document/213253/?arnumber=213253

http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf

Neither article makes any mention of Perl, which isn't terribly surprising, since BLACKER is still highly classified, with very little is publicly known about its design and operation. You'll find some discussion of BLACKER in my recent article: http://ieeexplore.ieee.org/document/7763734/ (Open access/free pre-print version: http://iqdupont.com/assets/documents/DUPONT_FIDLER-2016-Prep...)

A few points of note: it's rather weird to call BLACKER a "VPN"; it's likely much broader than this (it's a network, crypto suite, secure kernel, system architecture, etc), and yet encompasses a very different goal. In fact, the degree to which it originates out of secure kernel research is, we argue in our paper, somewhat unclear, and perhaps this is only a small part of the equation.

If anyone has any additional information about these early architectures, I would love to speak with you, contact me at http://iqdupont.com.

It was here thanks to acqq:

http://cahighways.org/wordpress/?p=5460

Yeah, BLACKER did quite a bit. It was a network MLS component like many others that came after it. GEMSOS, Boeing SNS Server, and DiamondTek LAN are examples. Modern variant would be an Octeon 2 or 3 PCI card with similarly secure software.

Too much to explain, though. BLACKER's main purpose was securing the connection between dumb terminals and things they connected to. It used crypto, MLS, and TEMPEST-style hardware. It was a network device as well. A VPN is closest term for modern audience to convey its main goals.

The second paper mentions BLACKER and MLS, but nothing about perl. The closest perl comes to MLS is "taint" mode, but that seems a stretch. The first paper is pay-walled. Are you sure you're not thinking of SELinux?

See:

http://cahighways.org/wordpress/?p=5460

That's the one. Thanks.

I wanted to link it but nothing came up in my bookmark search. As is typical. I think my bookmarks are too packed for search to even work right. So, I just described what I read in the past.

Reply on news.ycombinator.com