but not, "never directly connect it to the Internet"? Seems odd to me since you can use the same air-gap to configure the computer for your needs in the first place instead of turning a networked computer into an air-gapped one.
"But for Windows full-disk encryption it's that..."
But not an open-source operating system with access to the exact same security solutions? Why isn't using Tails or other Linux something that's at a minimum instead of a "you could if you like".
No mention of better air-gapping the computer by keeping modules attached to the motherboard to a minimum (usb cd-drives, removable 3.5" media readers).
Overall:
I am by no means a security expert, but as a lawyer who has to do due diligence on cloud providers (most fail as far as what they advertise or in being truly eligible), I would consider his described setup as very weak if the motive that makes you consider air-gapping in the first place is your first priority. It seems more like his second or third priority...
1) It's a huge pain to set up a single Windows system for offline updates now.
2) My opinion of Schneier's technical competence, at least on a tactical level, is not actually (nor has it ever been) particularly high. He's a Windows guy, and "management level". He is a good politician and spokesperson. He's still good enough for this particular thing, and much better at the human side, and essentially famous/rich enough to be immune from legal action as long as he's careful, and well known to people like GG. So, a good choice.
"He's a Windows guy" simply does not sit well with me in that scenario. What does it say that he can't be either inconvenienced or convinced by Greenwald or convinced by the very documents he's examining or recognize in the process of writing his post to take more precaution.
It's like he's trying to air-gap in the way that I try a tomato every 7 years to see if my taste buds have changed. They haven't, so I'll stick to what tastes good. But if a famine overtakes the world and tomatoes are somehow part of a new staple diet, I'll allow myself to be inconvenienced if it means that much to my survival.
but not, "never directly connect it to the Internet"? Seems odd to me since you can use the same air-gap to configure the computer for your needs in the first place instead of turning a networked computer into an air-gapped one.
"But for Windows full-disk encryption it's that..."
But not an open-source operating system with access to the exact same security solutions? Why isn't using Tails or other Linux something that's at a minimum instead of a "you could if you like".
No mention of better air-gapping the computer by keeping modules attached to the motherboard to a minimum (usb cd-drives, removable 3.5" media readers).
Overall: I am by no means a security expert, but as a lawyer who has to do due diligence on cloud providers (most fail as far as what they advertise or in being truly eligible), I would consider his described setup as very weak if the motive that makes you consider air-gapping in the first place is your first priority. It seems more like his second or third priority...