I created such a system (though to transfer Bitcoin Transactions/Signatures from an airgapped system). The problem is that if you have a lot of bi-directional traffic, you'd want to automate the process of scanning/storing the information. Suddenly, you just have a slow USB device.
What you want is to minimize your data to less than a 1Kb so that it can be manually transmitted.
Wouldn't it be easier to just have every port blocked except for a very simple application which has no privileges and just writes ASCII to some file? Such an application would be very easy to audit
You then need to trust that the kernel doesn't have a bug in the network stack. That trust might be justified, but keep in mind that even OpenBSD suffered a remotely exploitable vulnerability in their ipv6 stack ...
I think the general point stands though. While nothing is perfectly secure, having small and understandable components that are fully audited should allow a high level of safety
If a network stack on a modern computer is too dangerous, then use a modem (silly example: apt install minimodem) and an aux cable from the one computer's speaker to the other's mic jack, or a serial connection (not very familiar with those, can't say how complex the driver is there) or something similarly basic that you can audit a memory-safe implementation of
You advocate for really simple application layer, while having that on top of all the other complex communication layers. Implementations had multiple known vulnerabilities over the years. In case of vulnerability an attacker might be able to do much more damages with real-time access. Is it any safer than an USB stick?
On top of the complex communication layer we're trying to avoid? Umm, I'm not suggesting to run an aux cable or serial connection on top of a TCP stack, so I don't understand what you're saying
Edit: or do you mean the other way around, namely running a network stack on top of this (e.g.) serial connection? Also not what I meant but I wasn't explicit about that so this confusion would make sense. What I had in mind is doing whatever comms you want to do with the airgapped system, like logging/storing the diplomatic transmissions or whatever this system was for, via this super simple connection such that the airgapped system never has to do complex parsing or state machines as it would with something like USB or a standard kernel's network stack
Way before. Transactions in Bitcoin and small and simple (unless you have lots of inputs). You only need a QR code generator and a Transaction builder.
Yup, that's what I was thinking. Combining PSBT and QR is a very intuitive workflow. All the pieces are there waiting to be put together. Makes it more novel and impressive you did it way before.
What you want is to minimize your data to less than a 1Kb so that it can be manually transmitted.