Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Want to Know What Code Is Running Inside My Body”

backchannel.com

Post reply on HN
Print view View original

151–160 of 217 posts

Re: “I Want to Know What Code Is Running Inside My Body”

#151

Post by TeMPOraL »

llukas wrote: post #35
whorleater wrote: post #15

Earlier quoted context omitted.

As heartless as this sounds: the patient isn't the only person in the equation. There are investors that fund the medical research, a company has employees to pay, the hospital wants the best pacemaker available, etc.

Sure - why not ask patient for paid subscription for privilege of using pacemaker? Somebody please think of the investors...

Sure. Soon we'll have cloud-connected subscription-based freemium pacemakers that will shut down and kill everyone when the company making them gets acquihired.

I mean, I get the business incentives involved, but I also think it's high time to realize they're getting insane and should be altered.

Re: “I Want to Know What Code Is Running Inside My Body”

#152

Post by michaelt »

jordigh wrote: post #61
randyrand wrote: post #20

By extension should every device I own require me to have access to the source code and output data? Not a rhetorical question.

Y'know, back in the early 2000's and the days of Slashdot, it was quite common to find people who advocated for free software everywhere. Now we find people who like yourself have to specify that the radical position that all software should be free is something worthy of serious consideration. That they're not joking or trying to be deliberately provocative. What happened to us? Why did we go from boasting about ins…

  What happened to us?
My theory is this is HN-specific - and what you saw on slashdot was slashdot-specific.

Because HN started as part of YC its culture really likes VC-backed startups. And we think VCs want the kind of huge returns that are seen more often by closed source companies - they want to back the next Microsoft or Apple or Google or Facebook or Paypal or Amazon, not the next Red Hat or Canonical or MySQL.

It wouldn't make much sense for people to believe free software is a moral imperative, while aspiring to launch huge closed-source companies.

Re: “I Want to Know What Code Is Running Inside My Body”

#153

Post by belorn »

TickleSteve wrote: post #140
belorn wrote: post #137

Earlier quoted context omitted.

Security by obscurity is in practice almost always a bad idea. 1# security by obscurity gives a false sense of security. Under no circumstance should obscurity be used as a deciding factor behind a management decision. 2# security by obscurity cost money and time, and should only be used when all real form of security measures has been implemented. Even the military are currently not always implementing multi-token a…

I agree with your numbered points, but not the conclusion that its always a bad idea. Its common sense that I can't pick a lock if I cant find the lock. This says nothing about the quality of the lock or what is behind the lock.

Almost never. I know where the bank is, I know where the door to the bank is, but that should not make it easy to break into the bank. However, a gold storage might want to keep the location hidden, as they should have already implemented all the security procedures of a bank plus extra.

Spending time on security by obscurity should be a job for the small minority of people who already done everything else, and then only if there is a cost-benefit analyze that show cost of the obscurity to be less than the calculated gains.

Re: “I Want to Know What Code Is Running Inside My Body”

#154

Post by TeMPOraL »

r3bl wrote: post #48
smallnamespace wrote: post #12

Earlier quoted context omitted.

Maybe in a complete vacuum, but in reality, having access to source certainly makes it easier to look for vulnerabilities, and if the same software is in many devices, the cost of finding vulnerabilities is amortized. Security by obscurity obviously doesn't stop a determined attacker, but it does raise the barrier to entry for script kiddies.

No. Tell me, how many vulnerabilities are running wild on Linux, the software that powers... well, pretty much anything (including the servers through which you read this content)? Even if you find a vulnerability, it gets patched within hours and it may take a day or two for it to be distributed to everyone. > Security by obscurity [...] does raise the barrier to entry for script kiddies. Which script can help you f…

In the interest of honesty - first of all, "it gets patched within hours and it may take a day or two for it to be distributed to everyone" is not true. No matter how fast a vulnerability is patched, the distribution process usually takes days to weeks (c.f. Heartbleed bug, Canonical was apparently the first to find and fix it, and yet I've waited weeks to get the fix on my Ubuntu machine) for those who care and monitor those issues constantly, and months to years for everyone else.

Now there is an argument that there is a trivial way to find vulnerabilities in Open Source code - just diff the commits to look for fixed bugs, and attack those who didn't manage to update their software yet. That's part of the reason why e.g. Wordpress blogs and PHPBB forums get spammed so heavily.

Whether or not the benefits of Open Source are greater than those problems is another topic, but let's not pretend opensourcing doesn't lower the entry bar for attackers.

Re: “I Want to Know What Code Is Running Inside My Body”

#155

Post by amelius »

korethr wrote: post #88
radicality wrote: post #82

How about when I'm flying an airplane; I'm also putting my life in the hands of people that wrote the code that controls it and I have to trust that the plane won't shut itself down mid-flight because of faulty code. Should a similar argument be made here?

Perhaps you are being sarcastic, but I shall attempt to answer the question earnestly anyway. I've been reading up on aviation regs due to a recent interest in getting a pilot's license. By my understanding, airplanes certified by the FAA as airworthy undergo some fairly heavy testing to exactly determine and prove what their capabilities and limits are. Given that getting your prototype wrong can cause the plane to…

> Furthermore, once a plane is type certified, it can't be modified from that configuration without further testing to prove the modified configuration.

Would this work similarly with autonomous cars? For example, what if google wants to change one line of code in their car?

Re: “I Want to Know What Code Is Running Inside My Body”

#156

Post by michaelt »

TickleSteve wrote: post #139
michaelt wrote: post #132

Earlier quoted context omitted.

rules and regulations [...] in a different league than what most developers are familiar with. [...] the design (not the code) apparently did not take into account any messaging security, relying on obscurity as its only defence. Imagine you were building a suspension bridge to the highest safety standards, and you had people with microscopes manually inspect every grain of sand and cement that went into the foundati…

Inspection in this case is a proof that the design you're certifying is fit-for-purpose. So in your example, it would show that the loading and stresses on your washing lines were sufficiently low to meet the safety margin of the bridge. Certification of safety-related and medical devices is not a check-box exercise, it looks at the dynamic and static behaviour of your system as a whole (not just the software).

Perhaps I wasn't clear in my analogy.

I mean the washing lines weren't fit for purpose (just like the insecure comms wasn't fit for purpose) but the inspection didn't identify them as unfit for purpose (just like the inspection didn't identify the insecure comms as unfit for purpose)

Given that something unfit for purpose was certified, certification doesn't prove something is fit for purpose.

Of course, certification may indicate something is probably more fit for purpose than something that failed the same certification or didn't attempt it.

Re: “I Want to Know What Code Is Running Inside My Body”

#157

Post by nabla9 »

TickleSteve wrote: post #97
cooper12 wrote: post #75

Earlier quoted context omitted.

The sad part is that the companies will use this security by obscurity argument against open sourcing.

contrary to popular opinion.... Obscurity is good practice as one layer of a layered defence system. See "Defence in Depth" https://en.wikipedia.org/wiki/Defense_in_depth_(computing) "Defense in depth is originally a military strategy that seeks to delay rather than prevent the advance of an attacker by yielding space to buy time". We have to acknowledge that no system is perfect, there will always be holes, therefor…

Obscurity is one possible layer, but it's not very good. Obscurity has a cost for anyone working with the system.

Obscurity don't scale. Things that are commonly used should not use obscurity.

Somebody who mass produces computing equipment or software that many use can't use obscurity because it's economically efficient for attackers to look past obscurity. It's also unproductive to advice others to use some obscuring methods, because as soon as something becomes even slightly common, it can be detected and security of obscurity vanishes.

Obscurity must be obscure. Great minds think alike and it's very easy to build obscurity that is similar to what everyone else thinks is nice trick.

Genuine obscurity can provides additional security layer (in probabilistic expected value sense) against automatic or routine attacks. If obscurity requires even small time to figure it out, it's likely that attacker moves to next target. But it's hard to know how well the obscurity is working.

Re: “I Want to Know What Code Is Running Inside My Body”

#158

Post by 3chelon »

We hear a lot about how digital obsolescence is a growing problem, and almost all of it refers to not being able to access your old family photos and movies, or maybe old documents and spreadsheets. But what happens when your pacemaker is obsolete, the source code is long lost, and no-one knows how to update it?

Is this problem being addressed in any real way? 50 years in the future some of today's devices may still be operating in peoples' bodies, and it seems hard to believe that anyone would still have the knowledge and/or tools to upgrade them. And surely it's quite a big deal to open someone up to replace the hardware every 5 years?

Re: “I Want to Know What Code Is Running Inside My Body”

#159

Post by [deleted] »

TickleSteve wrote: post #97
cooper12 wrote: post #75

Earlier quoted context omitted.

The sad part is that the companies will use this security by obscurity argument against open sourcing.

contrary to popular opinion.... Obscurity is good practice as one layer of a layered defence system. See "Defence in Depth" https://en.wikipedia.org/wiki/Defense_in_depth_(computing) "Defense in depth is originally a military strategy that seeks to delay rather than prevent the advance of an attacker by yielding space to buy time". We have to acknowledge that no system is perfect, there will always be holes, therefor…

[deleted]

Re: “I Want to Know What Code Is Running Inside My Body”

#160

Post by Qwertious »

TickleSteve wrote: post #123
lordnacho wrote: post #119

Earlier quoted context omitted.

I think you're right that it can be used as a layer, but the reason we admonish against security-by-obscurity is that when you hide something, you often put less work into securing it properly. It's like when you leave a key for someone under a door mat. You don't often consider that the door might be easily kicked in by an intruder.

"you often put less work into securing it properly." Thats the problem right there.... not obscurity.

Well, it would be if we were robots who could effectively separate the two problems. But we're not, so we need to avoid obscurity if we want security.
Post reply on HN