So sue me: are lawyers really the key to computer security?
arstechnica.com
So sue me: are lawyers really the key to computer security?
1–10 of 24 posts
Re: So sue me: are lawyers really the key to computer security?
#2The class action suit against Dropbox sounds frivolous... the claimant says she wasn't even aware of the possible security lapse until days later when she read about it from a news source. That's on top of not being notified by Dropbox, which means her account wasn't accessed during the problem window. What possible damages could she be claiming?
Re: So sue me: are lawyers really the key to computer security?
#3Rather than drag the lawyers into this, (just more paperwork)why don't we look at it from the perspective of the tools we are using? For SQL injection, what stops databases from building an input scrubber that sits between the database and user input and scrubs input to block SQL injection? Or for that matter, why don't we see languages and frameworks used for web development touting the fact they include robust security that's easy to use?
Part of it is culture, we actually have to care about security and part of it is ease of security. If we build tools that make it easier to create a (more) secure environment and push it by default, we can at least make improving security easier.
Re: So sue me: are lawyers really the key to computer security?
#4The class action suit against Dropbox sounds frivolous... the claimant says she wasn't even aware of the possible security lapse until days later when she read about it from a news source. That's on top of not being notified by Dropbox, which means her account wasn't accessed during the problem window. What possible damages could she be claiming?
1. That the unfair competitive practices Dropbox engaged in when they told people untruths about their security caused her and people like her to select suboptimal storage solutions, which is a claim that arises from a California unfair competition law.
2. That some people in the class had their privacy invaded, the precise number of whom might be found during discovery.
3. That the negligence involved in opening this hole in Dropbox incurred damages at customers for instance by requiring them to take time off to move files off Dropbox.
4. That Dropbox breached its warranty and owes its customers a refund.
Happy to help.
Re: So sue me: are lawyers really the key to computer security?
#5Rather than drag the lawyers into this, (just more paperwork)why don't we look at it from the perspective of the tools we are using? For SQL injection, what stops databases from building an input scrubber that sits between the database and user input and scrubs input to block SQL injection? Or for that matter, why don't we see languages and frameworks used for web development touting the fact they include robust secu…
Nothing stops them from doing that. But they don't. Now what? See, we're back at the premise of the article.
Re: So sue me: are lawyers really the key to computer security?
#6Current computer security for companies is analogous to medieval castles: large crude systems with large support requirements and little concern for the security of small individual contributors. Once computer infrastructure effectively moves to less crude large scale centralized forms and provides effective minimal security for every small contributor will the key be available.
My home is my castle; my community infrastructure supports that implementation. Therefore the community does not require a castle. When personal computing equipment is equally robust, large computing systems will not be as necessary and neither will the legal implementations.
Laws and lawyers at the individual level are the key to computer security.
Re: So sue me: are lawyers really the key to computer security?
#7Rather than drag the lawyers into this, (just more paperwork)why don't we look at it from the perspective of the tools we are using? For SQL injection, what stops databases from building an input scrubber that sits between the database and user input and scrubs input to block SQL injection? Or for that matter, why don't we see languages and frameworks used for web development touting the fact they include robust secu…
Nothing stops them from doing that. But they don't. Now what? See, we're back at the premise of the article.
Partially because there hasn't been user demand for it to date. Such a change will require the programming community to start clamoring for tools to make things secure. We want speed, easy to use syntax, things like that.
Re: So sue me: are lawyers really the key to computer security?
#8Earlier quoted context omitted.
Nothing stops them from doing that. But they don't. Now what? See, we're back at the premise of the article.
Partially because there hasn't been user demand for it to date. Such a change will require the programming community to start clamoring for tools to make things secure. We want speed, easy to use syntax, things like that.
You'd be hard pushed to find a framework or language that didn't have, and recommend, ways to access a database that guarantee injection can't happen. If people choose not to use them, there's not a whole lot you can do.
That's just a small part of the puzzle, though, and not every security issue would or could be fixed by solutions of that nature. There is no fix, other than developers being informed, capable, and diligent.
Re: So sue me: are lawyers really the key to computer security?
#9Still, Halderman warned that too much litigation could cause companies to become excessively security-conscious. Software developers always face a trade-off between security and other priorities like cost and time to market. Forcing companies to devote too much effort to security can be as harmful as devoting too little.
While I suppose there is always some risk of obscure, exotic vulnerabilities that take substantial creativity to find, the breaches that have been making the news lately have not been of this kind; they've all involved "kindergarten security" as Bruce Schneier put it. Securing applications against these kinds of exploits is not difficult!
Re: So sue me: are lawyers really the key to computer security?
#10Rather than drag the lawyers into this, (just more paperwork)why don't we look at it from the perspective of the tools we are using? For SQL injection, what stops databases from building an input scrubber that sits between the database and user input and scrubs input to block SQL injection? Or for that matter, why don't we see languages and frameworks used for web development touting the fact they include robust secu…
I think you just described PHP's old magic quotes feature, which automatically escaped all user input to, among other things, block SQL injection. It's universally reviled as one of PHP's worst design decisions and is no longer part of the default feature set.