Just report, don't scoff experts. It makes you look stupid. Now what was the context? Ah, I see you were so busy trying to claim intellectual superiority (failed) that you forgot about that.
Bruce Schneier: Chrome OS's Security Claims "Idiotic"
21–30 of 34 posts
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#22These sorts of arguments really make me facepalm. Listen, Bruce, they don't literally mean that their OS will be completely and 100% totally impervious to any sort of malware or virus attack of any kind ever to exist ever in the future ever ever ever to infinity times infinity. They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future, and they're 1…
> They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future
By the way, that's what Microsoft meant when they released Windows 98... and 98SE and ME, and 2000, and XP, and 2003, and Vista, and 2008, and 7.
Pointless claim. Just deliver and we'll see.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#23"Guru" is probably the right word to use for Schneier at this point, and here's another great example of him inserting himself into a story he has no involvement in, making comments that betray a complete lack of awareness of the context of the story he's commenting on. Par, unfortunately, for the course. It is doubtless the case that Schneier is fielding constant phone calls from trade reporters asking for his opini…
You've been interviewed by a reporter, yes? His very next sentence could have been something like, "It's not going to be virus-proof, but I'm glad to see they're thinking about security early. There is still a lot that can be done at the operating system level to improve security for the user." The reporter would have cut that part out. It's not controversial enough. You could do the same thing with his blog post on…
You'll note that I didn't comment on his post about Gentry's homomorphic encryption scheme, for two reasons: (1) homomorphic encryption is a very boring topic, and (2) I don't feel like I have an authoritative argument for Schneier not being qualified to talk about it. Having dispensed with the straw man in your second graf, I'll take the 1st and 3rd in order.
I have been interviewed by reporters. And I have, in fact, made lots of mistakes with them. Security researchers are unnaturally attractive to trade reporters, and there's business value in cultivating contacts with them, and I've definitely let that process run too far in the past.
So, a mistake is a mistake. And thus, regarding your first graf, two responses:
(1) I stand by my original argument that Schneier doesn't appear to be close enough to Chrome OS security to comment on it, and his comments appear to misconstrue what Chrome OS is aiming for, and
(2) I stand by my original argument that this is an example of Schneier's business objective of inserting himself into every conversation about computer security again coming at a cost of his credibility.
Finally, you want to understand my need to pull Schneier down. I don't care if he's smart. I care that he's a guru. He's listened to uncritically by lay professionals, and his opinions about the problems they face are often not valuable. I'll add that Schneier's reputation in cryptography --- a field I am not a part of --- is not ironclad. If you want to stick up for a scientist, start with their citation record. Let us know what you find.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#24These sorts of arguments really make me facepalm. Listen, Bruce, they don't literally mean that their OS will be completely and 100% totally impervious to any sort of malware or virus attack of any kind ever to exist ever in the future ever ever ever to infinity times infinity. They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future, and they're 1…
> They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future By the way, that's what Microsoft meant when they released Windows 98... and 98SE and ME, and 2000, and XP, and 2003, and Vista, and 2008, and 7. Pointless claim. Just deliver and we'll see.
Linux has had a pretty long history of delivering on that claim...microsoft has not.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#25Earlier quoted context omitted.
> They mean that their OS will be considerably more resistant to any sort of reasonable malware attack in the foreseeable future By the way, that's what Microsoft meant when they released Windows 98... and 98SE and ME, and 2000, and XP, and 2003, and Vista, and 2008, and 7. Pointless claim. Just deliver and we'll see.
Linux has had a pretty long history of delivering on that claim...microsoft has not.
Linux isn't resistant to malware. It's resistant to users who want point-and-click installation of software downloaded from the web.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#26I think making a claim like users don't have to deal with viruses, malware, and security updates is potentially more dangerous than having an OS with a less robust security model. Even linux and BSD systems are vulnerable if malicious programs are given the necessary permissions to run. If a casual user hears something like, "This OS is immune to viruses", they're likely to be a lot less cautious about running progra…
You're right in spirit, but let's kill the "permissions" meme. There's no normally-used Unix permissions that make viruses difficult to implant on Unix systems, and there's nothing on most people's machines that a virus would want access to that intrinsically requires "root".
The leading causes of malware are single-user machines and point-and-click software installation from the web. To the extent that any OS allows these, it's susceptable.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#27Earlier quoted context omitted.
An infinite loop does not a virus make. With a multithreaded OS an infinite loop is not really a problem. Limiting resources to some defined level is a "solvable" problem.
The antivirus problem isn't a resource consumption problem. "The halting problem" is a CS synecdoche for the limitations of static analysis and the fundamental generality of what a "virus" is. He's saying, "we mathematically figured out a long time that trying to look at a computer program and predetermine what it will do before running it is a task that reduces to the halting problem." That this is a stupid way to l…
Sorry, that's a better explanation of what you meant but it's still not a problem.
You don't need to figure out what a program can do ahead of time if you limit what it can do at run time. You don't even need to let the user do anything at run time.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#28Earlier quoted context omitted.
An infinite loop does not a virus make. With a multithreaded OS an infinite loop is not really a problem. Limiting resources to some defined level is a "solvable" problem.
Allowing friendly programs to access resources but disallowing unfriendly ones is impossible, because it is impossible to distinguish between the two without some form of enforced signing that is impossible for the user to subvert(and who wants that?). And no, defaulting to reduced permissions for some programs is insufficient. People will still click "Ok, allow higher permissions" on programs if prompted. What's the…
Not much, but nothing says the user needs to be able to type 'rm -rf foo'. Most people are used to OS that are designed to be fast and permissive, but you can code a defensive OS.
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#29Earlier quoted context omitted.
The antivirus problem isn't a resource consumption problem. "The halting problem" is a CS synecdoche for the limitations of static analysis and the fundamental generality of what a "virus" is. He's saying, "we mathematically figured out a long time that trying to look at a computer program and predetermine what it will do before running it is a task that reduces to the halting problem." That this is a stupid way to l…
Sorry, that's a better explanation of what you meant but it's still not a problem. You don't need to figure out what a program can do ahead of time if you limit what it can do at run time. You don't even need to let the user do anything at run time.
You are arguing with the wall. I'm just explaining what Schneier meant by "2+2=3".
Re: Bruce Schneier: Chrome OS's Security Claims "Idiotic"
#30Earlier quoted context omitted.
You've been interviewed by a reporter, yes? His very next sentence could have been something like, "It's not going to be virus-proof, but I'm glad to see they're thinking about security early. There is still a lot that can be done at the operating system level to improve security for the user." The reporter would have cut that part out. It's not controversial enough. You could do the same thing with his blog post on…
You'll note that I didn't comment on his post about Gentry's homomorphic encryption scheme, for two reasons: (1) homomorphic encryption is a very boring topic, and (2) I don't feel like I have an authoritative argument for Schneier not being qualified to talk about it. Having dispensed with the straw man in your second graf, I'll take the 1st and 3rd in order. I have been interviewed by reporters. And I have, in fact…
Don't you kind of think homomorphic encryption is a big deal for what it allows? I mean, at it's core, running arbitrary computation on encrypted data for the later consumption of the decrypter is a very big deal, and can be a Cloud game-changer.
Schneier may not be the world's greatest guru, but he knows a lot and he writes well, which makes his opinion more relevant on average than almost anyone else's. If you want a similar amount of "street cred", write a book.
No seriously, I'd read a book by you guys, just write it, please.