Live data from Hacker News

Microsoft is a national security threat: ex-White House cyber policy director

theregister.com

221–224 of 224 posts

Re: Microsoft is a national security threat: ex-White House cyber policy director

#222

Earlier quoted context omitted.

>It’s a design fallacy that security through obscurity is good. Yet, still obscurity increases security. Reverse engineering is not trivial and raises the bar.

Any relevant links? I can share this: https://blog.invisiblethings.org/2008/09/02/three-approaches...

What would I need link for?

The point is simple - obscurity as an addition increases security.

Reverse engineering is not trivial and raises the bar.

Edit. Oh, your link supports that

>The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).

Re: Microsoft is a national security threat: ex-White House cyber policy director

#223

Earlier quoted context omitted.

>It’s a design fallacy that security through obscurity is good. Yet, still obscurity increases security. Reverse engineering is not trivial and raises the bar.

> Yet, still obscurity increases security. I disagree and think obscurity decreases security. It just gives the false belief of security.

Reverse engineering is not trivial and raises the bar.
Post reply on HN