Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Insecurity Industry

edwardsnowden.substack.com

Post reply on HN
Print view View original

301–310 of 386 posts

Re: The Insecurity Industry

#301

Post by MichaelMoser123 »

staticassertion wrote: post #146
MichaelMoser123 wrote: post #128

Earlier quoted context omitted.

Where is your legislation supposed to draw the line? In Rust you need to have occasional unsafe code - you can't even have a double linked list or bidirectional graph without unsafe code. Would you also outlaw jni calls in java?

The way this would likely end up being handled is the same as any other compliance. You define the threat model for your application and then justify why you're safe. In this case we'd be adding an explicit point to ensure that there are controls for attackers who can exploit memory safety issues. You could end up with controls like: 1. We sandbox our code, so even though it's C we feel that we're safe 2. We use a me…

would that imply that the state would have to review the design and implementation of every system under their jurisdiction? I think that would be a bit heavy for everyone involved.

Re: The Insecurity Industry

#302

Post by mark_l_watson »

Hermitian909 wrote: post #112
3pt14159 wrote: post #35

I'm not going to comment on Snowden's view of what liberal western states do when it comes to surveillance. I have my own opinion, but he's been right about stuff I'd disagreed with him in the past before so I'm gun shy about confronting his ideas again. On the topic of unsafe language though, he's absolutely right. We don't have to put up with this. We could pass a law and ban new code in unsafe languages from natio…

As a professional software engineer I'm not sure the idea of "safe" or "unsafe" programming languages is a coherent idea, or if it is then all languages are unsafe in my eyes. Yes C/C++ have more footguns than Java but there's no "hard line" in the safety differences and there are real and important things that need doing that it's not always clear can be reasonably done in another language. If you haven't, I'd encou…

I agree with this article’s criticism of managed languages (Java, C#) for systems programming, but the author does not convince me that Swift and Rust would not be much, much better to build safe(r) systems and infrastructure software.

Re: The Insecurity Industry

#303

Post by wly_cdgr »

imwillofficial wrote: post #131
wly_cdgr wrote: post #102

I doubt "real" engineering is better. It's just that attacking its artifacts doesn't scale, so it looks more secure. In fact, the average bridge or skyscraper is probably absolutely riddled with serious design and manufacturing flaws

The design process is pretty rigorous. Anything to back up your idea?

Challenger, Columbia (safety culture at NASA really improved after Challenger huh), Chernobyl, Three Mile Island, Fukushima, recent FL condo collapse, my average five story Brooklyn apartment building's basement and roof after a thunderstorm, Boeing's long and growing list of recent fuckups... is some stuff that comes to mind off the top of my head. Makes you wonder how many close calls, less major incidents, cracks that are noticed and repaired in time, buildings that happen to be demolished twenty years before collapsing to make way for redevelopment, etc we don't even hear about, no?

What about you - anything to back up your claim?

Re: The Insecurity Industry

#304

Post by aj3 »

danarmak wrote: post #284
justincormack wrote: post #276

Earlier quoted context omitted.

Surely though without a contract there is no liability? IANAL but imposing liability on gifts seems difficult.

If I build an unsafe boiler, and gift it to you, and then it explodes and kills you - am I not liable because it was a gift and not a sale? Can I disclaim away any liability and "fitness for purpose" when I gift you the boiler? ETA: the first couple of Google results say that no, product liability can't be disclaimed away - particularly when there is no contract or opportunity for bargaining. I am very much not a law…

Your second link mentions sellers avoiding liability by selling product (that can be inspected in stores) "as-is". It could be argued that open source falls in the same category. You have an opportunity to inspect it before using and if you don't like it or don't feel qualified to pass judgement, no one is forcing you to use it.

Re: The Insecurity Industry

#305

Post by tim333 »

m12k wrote: post #272

Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were se…

Laws are made by the government of the country in question and in this case the government, Israel, approved the sales and used them to its advantage.

Re: The Insecurity Industry

#306

Post by bob1029 »

> The greatest danger to national security has become the companies that claim to protect it

No. The greatest danger is lack of software supply chain management followed by near-universal disrespect for formal complexity management methods.

The only way I have found to win at this "are we actually secure" game is to minimize the number of parties you have to trust. The smaller you get this figure, the easier it becomes to gain control over your circumstances again. How many of us can immediately state the exact number of unique parties that we have to trust as part of building solutions for other people?

What about complexity? Most of the time, something is insecure not because of malicious intent (covered by the trust angle above), but because its so goddamn complex that no one can say for sure if its correct or not. Why do we tolerate this?

Re: The Insecurity Industry

#307

Post by aj3 »

ozim wrote: post #224
grncdr wrote: post #203

Earlier quoted context omitted.

How would this make running a personal website risky from a legal liability perspective?

Personal website - what if someone takes over your server and does malicious stuff? Are you going to put up with accountability that you might have misconfigured something and it allowed attackers to scam people or serve porn? You are perfectly sure that you are going to keep your small site updated all the time and you won't forget about it? Because that is where it is going - it is not just code that can be vulnera…

Cutting down things that are unnecessarily complex would be a good start. I.e. most websites out there could be easily replaced by static code generators. Webauthn and client certificates can be used to protect admin interfaces. Technology is here but there is no demand for it because making things less secure is way cheaper.

Re: The Insecurity Industry

#308

Post by aj3 »

m12k wrote: post #272

Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were se…

LEO and TLA need vendors with constant supply of exploits.

Re: The Insecurity Industry

#309

Post by red_trumpet »

m12k wrote: post #272

Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were se…

Iirc the software sold by the NSO group is considered a weapon under Israel law, so it is somewhat regulated. Not as heavily as nukes though.

This begs the question: Is there a compelling reason why selling weapons to other states should be legal?

Re: The Insecurity Industry

#310

Post by wly_cdgr »

jchook wrote: post #141
imwillofficial wrote: post #131

Earlier quoted context omitted.

The design process is pretty rigorous. Anything to back up your idea?

Not necessarily agreeing but reminded of the Harvard Bridge in Boston. I heard that though it was often called the MIT bridge (because it connects MIT campus to Boston), they felt fine with the name “Harvard” after learning it was structurally unsound. https://en.wikipedia.org/wiki/Harvard_Bridge

Smoots would have been ashamed, smh....
Post reply on HN