Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The six dumbest ideas in computer security (2005)

ranum.com

Post reply on HN
Print view View original

51–60 of 216 posts

Re: The six dumbest ideas in computer security (2005)

#51

Post by worthless-trash »

sweetjuly wrote: post #9

>Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb? Sure, but how does one get the knowledge on how to secure systems? Half the job of a security engineer is thinking like an attacker and trying to poke holes in it. Key mitigations like ASLR and stack canaries are so effective because they specifically block off key re…

As a security engineer, I can't agree more.

If you dont understand your enemy, you can not hope to defend against them.

Re: The six dumbest ideas in computer security (2005)

#52

Post by mcqueenjordan »

tptacek wrote: post #43
mcqueenjordan wrote: post #42

I agreed with much of the article and points made. Maybe I'm missing something (if so, would love to learn!) but I felt that the "Penetrate and Patch" section was a little naive. e.g. > Let me put it to you in different terms: if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years? I agree with the point that "Penetrate…

It's not naive so much as it is motivated by enmity for vulnerability research and vulnerability researchers, which was a thing from '98-'05 or so.

Ah, got it. Yeah that makes sense, thanks -- I missed how old this was.

Re: The six dumbest ideas in computer security (2005)

#53

Post by SQueeeeeL »

happymellon wrote: post #27
msla wrote: post #12

> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…

The fundamental flaw is normally "but doing it correctly would cost too much and take too long, what can we do for $5 and a chocolate bar?". Airline projects don't have the same level of issues because the FAA (or equivalent domestic authority) tells them to do it correctly.

Except when they don't, then you get the Boeing 747 MAX literally avoiding mandatory safety evaluations and ignoring engineers

Re: The six dumbest ideas in computer security (2005)

#54

Post by jjav »

josephg wrote: post #32
ufmace wrote: post #10

I wonder how well we all think this article has aged? "Penetrate and Patch" is supposedly dumb. But what do we practically do with that? We've seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what's there to do but patch it? If some software has never had a bug found…

I think this article has aged very well. > Also web browsers face a constant stream of security issues. What are we supposed to do instead? There's not much that users can do, but web browsers have spent the last decade moving away from "Penetrate and Patch" to much more proactive approaches. Eg, Chrome pioneered moving each tab to a separate process with full sandbox isolation. Firefox is talking about using webasse…

> my iPhone is more secure than linux for the same reason

The phrase "more secure" doesn't mean anything, I wish it wasn't used.

One needs to talk about the threat model(s) you care about and how a particular solution addresses them (or not). Any given solution can be both more secure and less secure than an alternative, depending on what threat models you care about. Which may well be different than the threat models someone else cares about.

If you unconditionally trust Apple and all government agencies which have power over Apple (e.g. NSLs) then one could say iOS has a more secure file access model than Linux. But that's a big if. Personally I could never trust a closed source proprietary solution.

Re: The six dumbest ideas in computer security (2005)

#55

Post by kgeist »

mcqueenjordan wrote: post #42

I agreed with much of the article and points made. Maybe I'm missing something (if so, would love to learn!) but I felt that the "Penetrate and Patch" section was a little naive. e.g. > Let me put it to you in different terms: if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years? I agree with the point that "Penetrate…

>if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years?

It also assumes software is static and never changes so it's possible to run out of vulnerabilities to find.

Re: The six dumbest ideas in computer security (2005)

#56

Post by Gigachad »

happymellon wrote: post #27
msla wrote: post #12

> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…

The fundamental flaw is normally "but doing it correctly would cost too much and take too long, what can we do for $5 and a chocolate bar?". Airline projects don't have the same level of issues because the FAA (or equivalent domestic authority) tells them to do it correctly.

Is there any real equivalent process for tech? It seems like the majority of security certifications is a box checking exercise where actually being secure has very little relation to how many boxes you checked.

Re: The six dumbest ideas in computer security (2005)

#57

Post by Gigachad »

superkuh wrote: post #41

Back in 2005 the idea that you shouldn't run every bit of executable code sent to you was drilled into people. Nowadays you can't use a commercial/institutional websites without doing the modern equivalent of opening random email attachments.

You also use an OS and browser which is space age technology compared to what they had in 2005. Back then a kid could write an email to install a rootkit on your computer. Now you'd get paid $100k+ if you could work out how to do that.

It also used to be common knowledge that if someone has physical access to your device, its game over. Which is something that is becoming rapidly untrue. If I hand my macbook to my friend for a day, I can be quite confident they haven't been able to defeat the boot chain security to replace my kernel with a malware version like you trivially could pre secure boot environments.

Another piece of common advice was to not use public wifi because anyone could steal your password or credit card details. Security advice from 2005 really hasn't held up much at all.

Re: The six dumbest ideas in computer security (2005)

#59

Post by Gigachad »

ufmace wrote: post #10

I wonder how well we all think this article has aged? "Penetrate and Patch" is supposedly dumb. But what do we practically do with that? We've seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what's there to do but patch it? If some software has never had a bug found…

The future is probably a two tiered system like what Apple is showing with Lockdown Mode. Normal users get the full speed fully functional system. And those who are at risk of being targeted use a locked down system with less convenience features but more security.

Along with better languages and tooling ruling out entire classes of exploits.

Post reply on HN