Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

251–260 of 386 posts

Re: The Insecurity Industry

#251

Post by Craighead »

kragen wrote: post #234
yosito wrote: post #231

Earlier quoted context omitted.

> it will be the end of open source Not if the rules are carefully targeted at SaaS and not at codebases. If the rules are targeted at SaaS, the liability is actually lower for open source because of the inherent transparency of everything open source code does.

Do you think Nancy Pelosi is going to ask Richard Stallman, the Debian Project Leader, and the Apache Foundation how the regulation should work? Or is she going to ask SalesForce, Google, Apple, and Microsoft?

Nobody should be asking Stallman anything

Re: The Insecurity Industry

#252

Post by Synaesthesia »

minusSeven wrote: post #245

Do people really think any of this is ever going to change? Governments don't give a shit, they time and again say they won't do something only to later do it in secret. We should at this point accept that this isn't going to change and move ahead with the belief that your data is already hacked and is not private anymore. We should discuss more on the exact consequences of this and take actions accordingly.

So not point in ever doing anything? Just give up.

A mass movement of people can force a government to change.

Re: The Insecurity Industry

#253

Post by cartoonworld »

sat0ri wrote: post #241
michaelt wrote: post #201

Earlier quoted context omitted.

> Don't hire people who are under qualified. Its really that easy. I understand what you're saying, but I'm not sure I agree. For example, look at Google Chrome. They've got mountains of cash. They've got loads of people working for them, and loads of job applicants if they want more. They've got a strong business case to work on security. They've got in-house pen testers, and a bug bounty program. They've got code r…

So many CVEs are due to their bug bounty program, hackers are incentivized to sell vulnerabilities to Google rather than exploiting them. CVEs are publicly disclosed after they are fixed, of course.

The CVEs are due to the bug reporting, the bugs are not.

The point is that memory safety bugs are the gift that keeps on giving.

You can throw as much money into the problem as you want, and the inherent complexity of memory management means you are still gonna ship bugs of all severity.

Re: The Insecurity Industry

#254

Post by arc-in-space »

littlestymaar wrote: post #150
ManuelKiessling wrote: post #139

Earlier quoted context omitted.

The dark pattern is that you don’t know it beforehand, not the paywall itself.

You know before typing your comment though. The real dark pattern would be if it had let you type and then ask for money to submit your comment.

You do have to start typing before it informs you, which means you already had a reply in mind. I agree that's pretty bad.

Re: The Insecurity Industry

#255

Post by kragen »

pjmlp wrote: post #246
kragen wrote: post #230

Earlier quoted context omitted.

The guy selling food on the street has liability in proportion to his profits; fifteen customers, fifteen potential food-poisoning cases. He can set his prices accordingly. Simon Tatham doesn't have any profits, but his PuTTY is installed on every developer's Windows machine. OpenSSL is installed on even more machines. How long do you think it would take your proposed regulatory regime to find that Kurt Roeckx owed s…

That is for the law makers to decide, If someone gets run down by a bicycle that a hobby repair shop failed to fix, it doesn't matter it was done for free by a guy that learned to repair bicycles during late nights.

People like Simon Tatham and Kurt Roeckx, however fallible they may be, are doing a much better job of deciding how software security should work on the internet than Nancy Pelosi and Mitch McConnell would. The question is not how we can give more power to Nancy Pelosi, Mitch McConnell, Amazon, Google, and whoever the Trump voters vote in as the next president, to regulate Sci-Hub, BitTorrent, Bitcoin, WikiLeaks, DeCSS, Matrix, GDB, and OpenSSL; the question is how we can take that power away from them.

When the wise must obey the commands of the foolish, disaster ensues.

Re: The Insecurity Industry

#256

Post by kragen »

neolog wrote: post #226
kragen wrote: post #199

Earlier quoted context omitted.

If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.

This makes no sense. Open source doesn't collect my personal information. (Except when it does, which is bad behavior.) Anyway, the law is capable of making reasonable distinctions where necessary.

Nearly every website that collects your personal information is running lots of open-source software. Sometimes, as with PHPSESSID and httpd logs collecting your IP, the collecting of that information is automatically done by that open-source software.

Re: The Insecurity Industry

#257

Post by trasz »

staticassertion wrote: post #250
trasz wrote: post #218

Earlier quoted context omitted.

It's many orders of magnitude cheaper than replacing all your software.

You can't just adopt that hardware and get memory safety. The hardware is providing support for a capabilities model, which you then have to adopt at a software level both within your OS, compiler, and application code. This also would break C and C++ ABIs, so it's very unlikely to get adopted for a number of cases. Further, CHERI is not enough to achieve temporal memory safety, it only provides the primitive that on…

Indeed, you need the whole stack. However, the (non-temporal) memory safety alone is still quite easy to get - the compiler will take care of it, as a programmer you just need to make sure your code doesn't get in the way by eg manually stashing pointers into non-pointer types. It's been demonstrated on large, real-world code bases, such as FreeBSD and PostgreSQL.

(Disclaimer: been there, done that, part of the CHERI team)

Re: The Insecurity Industry

#258

Post by michaelnik »

mehlmao wrote: post #90
stickfigure wrote: post #37

Earlier quoted context omitted.

We tried this with general aviation. Private plane manufacturers all went bankrupt, and now the minimum price for a new airplane is in the hundreds of thousands of dollars. Apply strict liability to software, and you'll see the same results. Every piece of software will have to be constructed with the care of a medical device. Expect most forms of technological progress to come to a halt. Some part of the HN crowd wi…

Private plane manufacturers went bankrupt, but more importantly, plane crashes have become incredibly rare.

In parallel the GA planes used got old. Imagine the same happening for the software!!!

In 2000, the average age of the nation's 150,000 single-engine fleet was more than 30 years. By 2020, the average age could approach 50 years

https://www.faa.gov/aircraft/air_cert/design_approvals/small...

Re: The Insecurity Industry

#259

Post by 2OEH8eoCRo0 »

lu4p wrote: post #33
2OEH8eoCRo0 wrote: post #13

Edward Snowden is a traitor or a coward. Daniel Ellsberg gave the pentagon papers to the press after trying to give them to Congress. He then fought the govt in court and won. Ellsberg is a patriot.

No he's not, he even stated, that he is fine with coming back to the US if he is guaranteed a fair trail. https://www.washingtonpost.com/news/the-switch/wp/2015/10/06...

Everyone is "guaranteed" a fair trial. As much as one can guarantee such a thing. Bill Cosby was just let out of prison because of shenanigans with his trial.

Re: The Insecurity Industry

#260

Post by teekert »

kragen wrote: post #199
pjmlp wrote: post #188

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quick…

If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.

Mostly open source does not gather data that is not needed for the service/program to function.
Post reply on HN