The six dumbest ideas in computer security (2005)
1–10 of 216 posts
Re: The six dumbest ideas in computer security (2005)
#2According to Slashdot this article was online since at least September 2005.
I would be interested to hear the author's thoughts on what has changed in the 18+ years since it was written.
Re: The six dumbest ideas in computer security (2005)
#3If I could come up with one dumb idea it would be something like:
You can trust large-organization to secure your device.
(especially for orgs that give themselves, advertisers or apps more access to the device than you have)
Re: The six dumbest ideas in computer security (2005)
#4Not convinced these are the dumbest (none of them is quite as dumb as requiring special characters in passwords, for example, and I'm not sure the fourth is dumb at all), or that they're six ideas. The first two are the same, and the third one is a special case of the same thing.
Re: The six dumbest ideas in computer security (2005)
#5Not convinced these are the dumbest (none of them is quite as dumb as requiring special characters in passwords, for example, and I'm not sure the fourth is dumb at all), or that they're six ideas. The first two are the same, and the third one is a special case of the same thing.
Yeah, and they didn't mention "storing your passwords in plain text"
Re: The six dumbest ideas in computer security (2005)
#6Looking back on that era, the hate towards hackers feels really misplaced. Yeah, at the time it was more local and more dominated by people doing it for the lolz but we kinda owe them a debt of gratitude. If they hadn't gotten everyone to stop being lazy about security we'd be in a very different place now, surrounded by rouge states and agencies launching hyper sophisticated attacks on infrastructure and data. That was also the era that trained the current generation of cybersecurity experts.
Re: The six dumbest ideas in computer security (2005)
#7Not convinced these are the dumbest (none of them is quite as dumb as requiring special characters in passwords, for example, and I'm not sure the fourth is dumb at all), or that they're six ideas. The first two are the same, and the third one is a special case of the same thing.
What’s the deal with special chars? A site made me use one today.
Re: The six dumbest ideas in computer security (2005)
#8According to Slashdot this article was online since at least September 2005. I would be interested to hear the author's thoughts on what has changed in the 18+ years since it was written.
Oof, well, I was going to say,
> My prediction is that the "Hacking is Cool" dumb idea will be a dead idea in the next 10 years.
… that won't age well, and apparently, that didn't age well. It won't happen in the next 10, either.
Nor will good engineering: as an industry, we a.) dislike the very idea that knowledge is required for software engineering and b.) every "Rust fixes this entire class of bugs, permanently" "oh god not the Rust evangelists" … yeah, the bugs will continue.
Re: The six dumbest ideas in computer security (2005)
#9>Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?
Sure, but how does one get the knowledge on how to secure systems? Half the job of a security engineer is thinking like an attacker and trying to poke holes in it. Key mitigations like ASLR and stack canaries are so effective because they specifically block off key resources and techniques that attackers use. It would be downright impossible to invent these mitigations (or even meaningfully understand them) if you did not already have a firm grasp on memory corruption and ROP. I'm not sure it's an argument I actually care to defend, but I do honestly believe that you can't be a strong security engineer if you don't have a grasp on the techniques your adversaries use.
Re: The six dumbest ideas in computer security (2005)
#10I wonder how well we all think this article has aged?
"Penetrate and Patch" is supposedly dumb. But what do we practically do with that? We've seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what's there to do but patch it? If some software has never had a bug found in it, does that actually mean that it's secure, or just that no skilled hackers have ever really looked hard at it?
Also web browsers face a constant stream of security issues. But so what? What are we supposed to do instead? Any simpler version doesn't have the features we demand, so you're stuck in a boring corner of the world.
"Default Permit" - nice idea in most cases. I've never heard of a computer that's actually capable of only letting your most commonly used apps run though. It's not very clear how you'd do that, and ensure none of them were ever tampered with, or be able to do development involving frequently producing new binaries, or figure out how to make sure no malicious code ever took advantage of whatever mechanism you want to use to make app development not terrible. And everyone already gripes about how locked-down iOS devices are, wouldn't this mean making everything at least that locked down or more?