Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

291–300 of 386 posts

Re: The Insecurity Industry

#291

Post by roflc0ptic »

hsod wrote: post #153
littlestymaar wrote: post #143

Earlier quoted context omitted.

> There's already a congressman on the record complaining about a "native Nigerian" committing code to Rust. Wow. It comes from the Libra hearing I guess? By any chance, do you have an link to the exact quote? Edit: as hsod answered below (I don't really get why this answer was flagged) the congressman isn't really “complaining” and it's not about a Nigerian committing to Rust, but to Libra itself.

It’s around 30 seconds of this clip https://www.c-span.org/video/?c4808083/user-clip-rust-langua... “I went ahead and did a GitHub search on who’s actually leading the development on the Libra core side and it looks like, I think it’s gonna be international because it looks like a native Nigerian that’s actually building the actual Libra core in front of the code development of Libra core” - congressman Denver Riggle…

It's an unsettling combination of literacy and illiteracy there.

Re: The Insecurity Industry

#292

Post by roca »

neolog wrote: post #228
roca wrote: post #124

Earlier quoted context omitted.

That paper has many problems. For example: > There is no particular need to rewrite existing C code, provided the same benefit can be obtained more cheaply by alternative implementations of C To be clear, those "alternative implementations" do not exist , and no-one actually working on C compilers or tools to make C code safer has been able to produce one, or even come up with a credible plan for producing one.

The author of that paper has written a safe C implementation. https://github.com/stephenrkell/libcrunch

I applaud him for giving it a go, but it's far from complete ... no use-after-free protection at all yet, for example.

Re: The Insecurity Industry

#293

Post by grncdr »

ozim wrote: post #224
grncdr wrote: post #203

Earlier quoted context omitted.

How would this make running a personal website risky from a legal liability perspective?

Personal website - what if someone takes over your server and does malicious stuff? Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn? You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it? Because that is where it is going - it is not just code that can be vulnera…

> what if someone takes over your server and does malicious stuff?

What if somebody steals my kitchen knife and uses it as a murder weapon?

> Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn?

Yes. This is (and always has been) the price of operating a website on adversarial public networks. We established relatively simple ways to make this possible even for individuals decades ago.

> You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it?

As I replied to the sibling comment, when was the last time there was RCE for Apache or Nginx configured to serve static files from a webroot? We are talking about personal websites here after all.

> Software is infinitely complex we can cut down complexity but then anything that is useful and complex will cost a lot more.

I think I disagree with you on where the threshold of usefulness is.

Re: The Insecurity Industry

#294

Post by kragen »

grncdr wrote: post #289
kragen wrote: post #222

Earlier quoted context omitted.

Are your HTTPD logs adequately secured? Are their security measures audited monthly, in keeping with established industry best practices? Do you have comments enabled on your blog? What's your policy for expunging blog posts about people exercising their right to erasure? How did this defamatory comment spam get past your comment filter? Did you know your open-source image thumbnailing software is being used on an il…

What a load of FUD. Personal websites don't need anything more complicated than an out-of-the-box config for apache or nginx to serve static files out of webroot. When's the last time that kind of setup was exploited? Sure if you add more complexity, you add more attack vectors, but there's an easy way to reduce your legal culpability there: just don't collect any PII. Even in the scenario you propose where anonymous…

Clearly you've never had to be responsible for PCI compliance. PCI auditors have no patience for arguments like "When's the last time that kind of setup was exploited? If you add more complexity, you add more attack vectors!" and just want you to install the damned antivirus software like their guidelines say. Yes, even though you're running Linux. No, they don't care that there's a CVE in ClamAV every two months. They don't make the rules. And PCI DSS is written by for-profit companies that lose money when their rules don't work. Legislators only lose money when their campaign donors don't donate enough to get them re-elected and nobody will hire them for speaking engagements.

You're coming at this whole thing from the perspective that wise and sane rules would be put in place and then sanely enforced for the welfare of everybody—by the same US government that told people not to wear face masks to protect against covid, while also shipping defective covid tests from the CDC and prohibiting the use of any other covid tests. And that's a case where nobody was in a position to profit by making the rules hard to comply with.

Listen, you know and I know that you can serve a personal website perfectly well with /var/www and a stock Apache config. But the proposal we're discussing here is precisely to take that judgment call away from people like you and me and give it to people like Donald Trump, using laws written by, most likely, lobbyists from Oracle and Microsoft.

Re: The Insecurity Industry

#295

Post by matheusmoreira »

3pt14159 wrote: post #35

I'm not going to comment on Snowden's view of what liberal western states do when it comes to surveillance. I have my own opinion, but he's been right about stuff I'd disagreed with him in the past before so I'm gun shy about confronting his ideas again. On the topic of unsafe language though, he's absolutely right. We don't have to put up with this. We could pass a law and ban new code in unsafe languages from natio…

Safer languages like Rust are awesome but cannot solve all of these problems.

Code reflects the programmer's understanding of the world. If this understanding is flawed, the logic will also be flawed.

Re: The Insecurity Industry

#296

Post by mark_l_watson »

Great article that I am sharing with non-tech friends and family.

The most powerful point is to stop using unsafe programming languages. I usually use Common Lisp (for almost 40 years now), but I have been experimenting a lot with Swift over the last year. I have little experience with Rust.

I have seen comments that Swift and/or Rust are not appropriate for operating systems and general systems programming, but I call bullshit on that. The problem is a financial problem, expensive to pay for difficult to hire Rust and Swift developers to rewrite billions of lines of code. But it should be done. I pay an incredible amount of money to Apple every year and I expect it from them. Same for Microsoft customers (and Google).

Re: The Insecurity Industry

#297

Post by yabones »

m12k wrote: post #272

Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were se…

It's even more insane when you remember that strong encryption was regulated as munitions until the mid 90s [1,2] - and actual cyber-weapons aren't today.

Software that can cause real damage to not just data and business activities, but endanger lives is completely legal to sell to despotic lunatics. If you sold a bag of fertilizer to a Syrian you'd go straight to Guantanamo, but somehow this is okay.

[1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

[2] https://web.archive.org/web/20051201184530/http://www.cyberl...

Re: The Insecurity Industry

#298

Post by nonameiguess »

jonas21 wrote: post #105
lifeisstillgood wrote: post #40

I tend to bang on about software not as engineering but as literacy. It makes some sense even here - that bad code is as common as bad law - and often for the same reasons, politics, money, and hard questions "Engineering" is a wide subject - the big stuff is carefully built and highly regulated - bridges and buildings. But as we go down the scale we see engineering give way to the problems of politics and money - to…

Also, traditional engineers design things to withstand conditions that they would reasonably face in ordinary use, with some additional safety factor. They don't design them to withstand deliberate attacks by nation-level actors like we're seeing here. If a car explodes because it got hit by an artillery shell, would anyone hold the automotive engineers responsible? If a building collapses because a bomb was dropped…

In many cases, these are public or quasi-public works, and security is a cooperative venture between the engineers who develop vulnerable structures and the state. Rather than building bridges to withstand artillery strikes, the nation itself implements national anti-missile defense making it quite difficult to launch an artillery strike, and if one gets through, they strike back.

I'm not really sure how to analogize this with software. The reality is some communications networks were just never meant to be secure. This isn't unique to the Internet. Nothing ever stopped anyone from tapping your phone and stealing your personal information that way except that it is illegal. On the other hand, a whole lot technical measures are in place to make sure it is very difficult and maybe impossible to "tap" a military or classified communications network at all. Nobody can stop you from intercepting radio, but good luck breaking the encryption.

But the national security infrastructure can't extend that level of protection to everyone, just as average citizens don't get police escorts and personal bodyguards assigned from the secret service. If someone wants to shoot you, the only thing the state does to stop them is make it illegal. Otherwise, it's on you to protect yourself, and we don't hold clothing manufacturers liable for not making your t-shirt bulletproof.

Re: The Insecurity Industry

#299

Post by olabyne »

imdoor wrote: post #173

> Fixing the hardware, which is to say surgically removing the two or three tiny microphones hidden inside, is only the first step of an arduous process, and yet even after days of these DIY security improvements, my smartphone will remain the most dangerous item I possess. What's the purpose of these microphones? Do they pose more threat than the standard non-hidden microphone?

These are the "standard microphones" of any modern smartphone. One microphone at the bottom, for calls, and 1 or 2 at the top, for stereo sound while recording videos and noise cancelling while doing call

Re: The Insecurity Industry

#300

Post by mark_l_watson »

grncdr wrote: post #293
ozim wrote: post #224

Earlier quoted context omitted.

Personal website - what if someone takes over your server and does malicious stuff? Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn? You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it? Because that is where it is going - it is not just code that can be vulnera…

> what if someone takes over your server and does malicious stuff? What if somebody steals my kitchen knife and uses it as a murder weapon? > Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn? Yes. This is (and always has been) the price of operating a website on adversarial public networks. We established relatively simple wa…

I agree that Apache and Nginx are not critical attack surfaces, especially for static web sites. I have been experimenting with running static sites on Cloudflare Pages, delegating security and infrastructure to them. This goes against my desire for decentralization, however. I usually use GCP for my web sites and it is so little effort to occasionally start a fresh VPS, a few git pulls, and copy an Nginx config file, and flipping DNS settings. Automating this process to happen frequently would avoid the problems associated with hackers taking over your servers and use them long term.
Post reply on HN