> #1) Default Permit
I guess author of this post is no longer with us because they got heart attack when npm and similar rose to prominence.
The six dumbest ideas in computer security (2005)
91–100 of 216 posts
Re: The six dumbest ideas in computer security (2005)
#92> #1) Default Permit I guess author of this post is no longer with us because they got heart attack when npm and similar rose to prominence.
[deleted]
Re: The six dumbest ideas in computer security (2005)
#93A reminder that a big part of the subtext of this piece is a reactionary movement against vulnerability research that Ranum was at the vanguard of. Along with Schneier, Ranum spent a lot of energy railing against people who found and exploited vulnerabilities (as you can see from items #2, #3, and #4). It hasn't aged well. I'm not sure there's anything true on this list that is, in 2023, interesting; maybe you could…
Thanks for the context! I was too young to know these backstories.
Re: The six dumbest ideas in computer security (2005)
#94> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…
[deleted]
Re: The six dumbest ideas in computer security (2005)
#95> One of the best ways to get rid of cockroaches in your kitchen is to scatter bread-crumbs under the stove, right? Wrong! That's a dumb idea. One of the best ways to discourage hacking on the Internet is to give the hackers stock options, buy the books they write about their exploits, take classes on "extreme hacking kung fu" and pay them tens of thousands of dollars to do "penetration tests" against your systems, r…
[deleted]
Re: The six dumbest ideas in computer security (2005)
#96> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…
[deleted]
[deleted]
Re: The six dumbest ideas in computer security (2005)
#97>Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb? Sure, but how does one get the knowledge on how to secure systems? Half the job of a security engineer is thinking like an attacker and trying to poke holes in it. Key mitigations like ASLR and stack canaries are so effective because they specifically block off key re…
[deleted]
Re: The six dumbest ideas in computer security (2005)
#98Earlier quoted context omitted.
The fundamental flaw is normally "but doing it correctly would cost too much and take too long, what can we do for $5 and a chocolate bar?". Airline projects don't have the same level of issues because the FAA (or equivalent domestic authority) tells them to do it correctly.
Is there any real equivalent process for tech? It seems like the majority of security certifications is a box checking exercise where actually being secure has very little relation to how many boxes you checked.
[deleted]
Re: The six dumbest ideas in computer security (2005)
#99> My prediction is that in 10 years users that need education will be out of the high-tech workforce entirely, or will be self-training at home in order to stay competitive in the job market. My guess is that this will extend to knowing not to open weird attachments from strangers. And yet, just yesterday I've seen a TV ad explaining how to not get phished out of your money through your banking app. I think it a runn…
[deleted]
Re: The six dumbest ideas in computer security (2005)
#100No billion dollar company is anywhere near as glib has the author makes them out to be. Maybe my experience varies, but the European companies I've worked with have strict cybersecurity liability, and they take every aspect of security seriously and do not just pat themselves on the back smugly, as OP portrays. Maybe this was the case in the 90's, but it sure is not the case today. EDIT: I deleted most of my post bec…
[deleted]