Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

71–80 of 386 posts

Re: The Insecurity Industry

#71

Post by [deleted] »

api wrote: post #64
o8r3oFTZPE wrote: post #11

"For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product." That sort of discussion is quickly dismissed on HN. And probably elsewhere on the web/over the internet. Instead we frequently see discussion blaming users of the software, i.e., Microsoft's customers, or even suggestions to make the customer liable, or comments from "…

Put liability on software and you will halt innovation almost completely. It won't lead to a utopia of provably safe systems and secure languages, but to a dystopia of paranoid risk-averse companies refusing to allow any form of innovation or use any code that is not already in use. Instead of clean bug-free code we'll end up with code that looks like OpenSSL, ugly as hell but relatively bug-free after decades of bru…

[deleted]

Re: The Insecurity Industry

#72

Post by renewiltord »

strangeattractr wrote: post #70
renewiltord wrote: post #60

Earlier quoted context omitted.

I have a personal philosophy: "if you can't do it well, don't do it at all". That's because I prize my ability at what I do. I am good at it. I am a craftsman. Not like these fly-by-night characters busy dropping concrete on people's heads. Maybe I need to teach these "real engineers" something about building things haha: "If you can't do it without killing people, don't do it". Man, that's a motto for the ages. You'…

Why bother with the software engineering, your moral sensibilities are needed everywhere. It's not every day someone emerges capable of writing a todo app in react without killing anyone

HAHA! What can I say? Some of us are made of sterner stuff.

Re: The Insecurity Industry

#73

Post by quickthrower2 »

dmoy wrote: post #18
o8r3oFTZPE wrote: post #11

"For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product." That sort of discussion is quickly dismissed on HN. And probably elsewhere on the web/over the internet. Instead we frequently see discussion blaming users of the software, i.e., Microsoft's customers, or even suggestions to make the customer liable, or comments from "…

Most of the people I went to Uni with ended up in fields where the companies are liable for bad stuff, to a certain degree. It does exist. However: * you get paid a lot less * the companies and industries move very slowly * you spend a lot more time writing long-form, some time just re-using existing stuff wholesale, and almost no time building actually new things I mean like Real Engineering fields. What we do in so…

Is moving more slowly in software a bad thing? I can just imagine an alternative world where people are better off, using sites that look like HN but are secure and work in their best interest.

Re: The Insecurity Industry

#74

Post by sydthrowaway »

throwmeawayya wrote: post #55
lu4p wrote: post #33

Earlier quoted context omitted.

No he's not, he even stated, that he is fine with coming back to the US if he is guaranteed a fair trail. https://www.washingtonpost.com/news/the-switch/wp/2015/10/06...

Did the US government explicitly deny him a fair trail?

Look at the dirty tricks they employed with Assange. Snowden’s paranoia has been vindicated.

Re: The Insecurity Industry

#75

Post by fortuna86 »

throwmeawayya wrote: post #55
lu4p wrote: post #33

Earlier quoted context omitted.

No he's not, he even stated, that he is fine with coming back to the US if he is guaranteed a fair trail. https://www.washingtonpost.com/news/the-switch/wp/2015/10/06...

Did the US government explicitly deny him a fair trail?

Did the FBI deny D.B. Cooper a fair trial?

Re: The Insecurity Industry

#78

Post by jodrellblank »

nyolfen wrote: post #44
Veserv wrote: post #42

Earlier quoted context omitted.

The gp is arguing that companies should be held liable for the harm that they can and do cause. You are countering that argument by claiming that doing so would require all companies to adopt onerous measures. However, that counter argument is only valid if we assume that all companies can cause the same amount of harm and thus have equal liability, and that doing so is unavoidable. That assumption is deeply flawed.…

how does linux fare in this scenario? few things are as critical in terms of infrastructure

All the internet backbone routers, endpoint routers and switches, hardware firewalls, VPN concentrators, the SSH daemons, SSL software, RSA keyfobs and the like, the content delivery networks and DNS ecosystem, SSL public trust system, the connectivity providers from ISP networks and national and international fibre connections to cellular and wifi networks, web browsers which billions of people use to interact with untrusted content, (datacenters, AT&T Long Lines building style classic phone system, the postal service, electricity subsystems, food and water supplies...), even staying in tech you've basically got to exploit something else before you get to whatever underlying OS there is and even if you get to it there's not necessarily a need to attack it.

NotPetya which took down Maersk and did $300Mn of damages was apparently spread (through their Windows AD) by compromised admin accounts which they were lax at managing[1] rather than kernel exploits. The SolarWinds Orion security flaws were blamed on weak passwords, not OS kernel exploits. And if getting inside, something like last month's SystemD/polkit exploit[2] shows that attacking the kernel isn't always necessary for privilege escalation.

Linux the kernel is important but it's the heart inside the ribcage, not the first or last line of defense, or the main thing to target.

[1] https://gvnshtn.com/maersk-me-notpetya/

[2] https://github.blog/2021-06-10-privilege-escalation-polkit-r...

Re: The Insecurity Industry

#79

Post by pvarangot »

csande17 wrote: post #65
zarzavat wrote: post #31

Earlier quoted context omitted.

Actually it's simpler. People and organizations would just move to a jurisdiction where such liability laws didn't exist. Apple would move. Microsoft would move. Google would move. And then the US would be forced to decide whether to accept imports of foreign devices and software (created under the no-liability framework) or to stay with homegrown technology frozen in time. The best thing you can say about this propo…

Tech companies can't even manage to leave San Francisco's outrageous cost of living and rising crime, much less the United States.

You think they are trying? When VC and executives live in walled castles and own multiple rental and investment property?

I mean the hub thing and synergistic collaboration are cool but employees are not 3x more productive because of it.

Re: The Insecurity Industry

#80

Post by CrazyPyroLinux »

throwmeawayya wrote: post #56
nextos wrote: post #21

Earlier quoted context omitted.

I completed a MSc in Formal Methods a decade ago, and I've worked in software projects where the level of rigor was equivalent or superior to any classical engineering field. For example, railway signaling or some real time control systems. We handed in complex artifacts that have had zero defects throughout their lifetime (> 15 years). I believe lightweight formal methods are quite promising and might let software m…

How does liquid haskell compare to typescript?

Obligatory joke: https://twitter.com/fireship_dev/status/1383835506664906756
Post reply on HN