Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

111–120 of 386 posts

Re: The Insecurity Industry

#111

Post by andyferris »

jonas21 wrote: post #105
lifeisstillgood wrote: post #40

I tend to bang on about software not as engineering but as literacy. It makes some sense even here - that bad code is as common as bad law - and often for the same reasons, politics, money, and hard questions "Engineering" is a wide subject - the big stuff is carefully built and highly regulated - bridges and buildings. But as we go down the scale we see engineering give way to the problems of politics and money - to…

Also, traditional engineers design things to withstand conditions that they would reasonably face in ordinary use, with some additional safety factor. They don't design them to withstand deliberate attacks by nation-level actors like we're seeing here. If a car explodes because it got hit by an artillery shell, would anyone hold the automotive engineers responsible? If a building collapses because a bomb was dropped…

This is an interesting point.

I think the difference here is that no car could be engineered to withstand an artillery shell, whereas we can imagine an iPhone not susceptable to this particular vulnerability (it already exists).

Perhaps one argument is that the space of _potential_ vulnerabilities in something as complex as an iPhone is so huge that it just isn't feasible to create one that can withstand all network-based attacks (in which the attacker hasn't obtained user consent, Apple's signing keys, etc)? However I'm not sure if I buy that argument, or not...

Re: The Insecurity Industry

#112

Post by Hermitian909 »

3pt14159 wrote: post #35

I'm not going to comment on Snowden's view of what liberal western states do when it comes to surveillance. I have my own opinion, but he's been right about stuff I'd disagreed with him in the past before so I'm gun shy about confronting his ideas again. On the topic of unsafe language though, he's absolutely right. We don't have to put up with this. We could pass a law and ban new code in unsafe languages from natio…

As a professional software engineer I'm not sure the idea of "safe" or "unsafe" programming languages is a coherent idea, or if it is then all languages are unsafe in my eyes.

Yes C/C++ have more footguns than Java but there's no "hard line" in the safety differences and there are real and important things that need doing that it's not always clear can be reasonably done in another language.

If you haven't, I'd encourage you to read the paper "Some Were Meant For C"[0] on why C still doesn't have a real replacement (though it could in the future).

[0] https://www.cl.cam.ac.uk/~srk31/research/papers/kell17some-p...

Re: The Insecurity Industry

#113

Post by larsiusprime »

rognjen wrote: post #82

While his message is undoubtedly important I find his writing style is overly condescending and detracts from the message.

C'mon. Compared to what I'm used to from the median big shot internet blogger or NYTimes op-ed page, Snowden is positively pulling his punches here.

Re: The Insecurity Industry

#114

Post by KirillPanov »

high_byte wrote: post #107

>basically turns the phone in your pocket into an all-powerful tracking device that can be turned on or off, remotely, unbeknownst to you, the pocket’s owner even more so with Android & iOS.

Targeting those is for n00bs.

Backdooring the modem firmware is far more useful, and reliable. Not to mention undetectable -- not only is the user unable to recompile or replace this firmware, they can't even get a checksum of it. Qualcomm's modem chips get their own private NAND flash that they can use as they please.

Re: The Insecurity Industry

#115

Post by DantesKite »

dcow wrote: post #108
mikewarot wrote: post #10

I was all ready to post a reply... when I was hit by the darkest pattern of all... you must pay to do so, with no hint prior to that moment.

Substack replies are paid? Hmm. Thinking about this right now: annoying sure but why do you consider this pattern dark? I bet it reduces spam and trolling by orders of magnitude unlike say confusing cookie dialogs designed to make you surrender all your private info.

Seems like it would lead to marginally better discussions too. Or at least, very very heated ones.

Re: The Insecurity Industry

#116

Post by dylan604 »

jonas21 wrote: post #105
lifeisstillgood wrote: post #40

I tend to bang on about software not as engineering but as literacy. It makes some sense even here - that bad code is as common as bad law - and often for the same reasons, politics, money, and hard questions "Engineering" is a wide subject - the big stuff is carefully built and highly regulated - bridges and buildings. But as we go down the scale we see engineering give way to the problems of politics and money - to…

Also, traditional engineers design things to withstand conditions that they would reasonably face in ordinary use, with some additional safety factor. They don't design them to withstand deliberate attacks by nation-level actors like we're seeing here. If a car explodes because it got hit by an artillery shell, would anyone hold the automotive engineers responsible? If a building collapses because a bomb was dropped…

That depends really. In the US, nuclear power plants are supposed to be able to withstand a certain amount of damage, specifically a direct impact of a certain sized plane (even before 9/11).

So, like all things, it's a bit of a matter of perspective.

Re: The Insecurity Industry

#117

Post by dylan604 »

mikepurvis wrote: post #110
SV_BubbleTime wrote: post #97

Earlier quoted context omitted.

If there is one thing politicians are surely better at it than programmers is making decisions about what programming languages should be used! /s Yes on theme, but no on ”there aught to be a law” that bans C/C++ because of an evolving goal of memory safety. When Rust++ comes out surely there will be people complaining that Rust isn’t safe, and so on. Best case is you make the consequence punishable (as was described…

Other industries handle this kind of thing with a layer of indirection: instead of laws from the state, the state imbues a professional body with certification power, and the body sets standards by consensus or whatever other process among their members. So if you're an architect, or lawyer, or tradesperson, or whatever, you have to do things in the manner prescribed or you lose your license. I know this kind of thin…

Anytime gov't gets involved though, you have to consider how the lobbiest will get involved. So a proponent with deep pockets that is thouroghly entreched with a language about to be "banned" decides to hire a lobbiest to convince these "well educated in all things" gov't reps. Yet proponents of "safe" languages have no cash to spend. Which language is going to get banned then?

Re: The Insecurity Industry

#118

Post by ARandomerDude »

mehlmao wrote: post #90
stickfigure wrote: post #37

Earlier quoted context omitted.

We tried this with general aviation. Private plane manufacturers all went bankrupt, and now the minimum price for a new airplane is in the hundreds of thousands of dollars. Apply strict liability to software, and you'll see the same results. Every piece of software will have to be constructed with the care of a medical device. Expect most forms of technological progress to come to a halt. Some part of the HN crowd wi…

Private plane manufacturers went bankrupt, but more importantly, plane crashes have become incredibly rare.

True but that's the trivial case. You'll never get food poisoning if we outlaw food, never get into a car accident if we outlaw cars, ...

The point is there should be a better way that just pull the plug on anything potentially unsafe.

Re: The Insecurity Industry

#119

Post by dylan604 »

KirillPanov wrote: post #114
high_byte wrote: post #107

>basically turns the phone in your pocket into an all-powerful tracking device that can be turned on or off, remotely, unbeknownst to you, the pocket’s owner even more so with Android & iOS.

Targeting those is for n00bs. Backdooring the modem firmware is far more useful, and reliable. Not to mention undetectable -- not only is the user unable to recompile or replace this firmware, they can't even get a checksum of it. Qualcomm's modem chips get their own private NAND flash that they can use as they please.

Thanks for that. I'll sleep well now. These are the litteral nightmare scenarios.

Re: The Insecurity Industry

#120

Post by dylan604 »

ASalazarMX wrote: post #8
bambax wrote: post #5

> it is still hard for many people to accept that something that feels good may not in fact be good This strikes me as surprising. I have always been taught the opposite: if it feels good, it's probably bad for you, or illegal, or immoral, or all three.

I'd take out the immoral, as it feels puritan. Also, there are nice things that are good, legal and moral, like stretching after a good night sleep, a professional massage, ad blocking, etc. Maybe I'm being too literal here.

Yeah, I'm sure there are some that would think ad blocking as immoral as you're "trying o get something for free" blah blah

As puritan as it feels, a large part of the population likes it that way and want it even more strict.

Post reply on HN