Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security is Mathematics

daemonology.net

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Security is Mathematics

#31

Post by barrkel »

Tycho wrote: post #22
jdp23 wrote: post #11

Earlier quoted context omitted.

Also an excellent point. Ross Anderson started pushing the term "Security Engineering" around 2000 and economics were a big part of it.

Can you elaborate on the economics involved, please? Sounds interesting.

Economics is about the study of choice, at a deep level: the study of choice under conditions of scarcity, or with constraints (a definition like that is in most introductory textbooks). It's almost like psychology applied to crowds of interacting agents.

(Some people seem to get the idea economics is like accounting but vaguer, like a climatologist is to a weatherman or something. Macro economics is the bit that gets in the media most often, but it's also the most ideology-based rather than fact-based.)

Re: Security is Mathematics

#32

Post by jdp23 »

Tycho wrote: post #22
jdp23 wrote: post #11

Earlier quoted context omitted.

Also an excellent point. Ross Anderson started pushing the term "Security Engineering" around 2000 and economics were a big part of it.

Can you elaborate on the economics involved, please? Sounds interesting.

The Workshop on Economics and Security has some great stuff http://weis2010.econinfosec.org/

Here's Ross's "Economics and Security" resource page http://www.cl.cam.ac.uk/~rja14/econsec.html

Re: Security is Mathematics

#33

Post by shoo »

Someone wrote: post #29
dkarl wrote: post #18

Knuth is famous for the remark "Beware of bugs in the above code; I have only proved it correct, not tried it", and the implicit statement that a proof-of-correctness is not adequate to ensure that code will operate correctly is one I absolutely agree with My boss told me a similar story of a computer science professor giving a cross-group talk in which he pitched the concept of formal methods to a group of physicist…

You can see that computer science is an applied science. A mathematics professor would have given a proof that such an algorithm exists or, more likely, that algorithms exist for solving several more general problems, and left it at that.

And unless you were especially lucky, the existence proof would be non-constructive.

Re: Security is Mathematics

#34

Post by [deleted] »

Tycho wrote: post #22
jdp23 wrote: post #11

Earlier quoted context omitted.

Also an excellent point. Ross Anderson started pushing the term "Security Engineering" around 2000 and economics were a big part of it.

Can you elaborate on the economics involved, please? Sounds interesting.

[deleted]

Re: Security is Mathematics

#35

Post by leoc »

stcredzero wrote: post #10
jdp23 wrote: post #8

Computer security is a social science, so degrees in ethnography, epistemology, or organizational behavior are a lot more relevant than mathematics. Agreed that math teaches you rigorous thinking and questioning assumptions, but outside of the narrow areas of cryptography and systems analysis the specific skills you learn aren't that important for security work.

Right. I don't think thorough economic analyses come into play nearly enough when people think about security.

"Amateurs study cryptography; professionals study economics." - Allan Schiffman

Re: Security is Mathematics

#36

Post by danielparks »

chwahoo wrote: post #30

Where the author's narrative breaks down is when he draws a parallel between security and proofs of theorems . The closer connection is between security and adequacy of theorems. It is true that you need to make sure your software conforms to its specifications and that process does involve informal (or formal) proof-like reasoning, but that is only a small part of the challenge. This is the part that mathematicians…

Obviously I can’t speak for Colin Percival, but I think that the point of the article is quite a bit simpler:

I read this as saying that the mindset required to write proofs is similar to the mindset required to write secure software. The proof mindset is useful for considering “all the real-world ways that things could go wrong.”

I think the paragraphs about Knuth’s famous quote just muddy the water.

Re: Security is Mathematics

#37

Post by [deleted] »

leif wrote: post #26

Forget security, programming is mathematics. If you program, you should be doing this whether you're writing security code or not. Nothing saves me more keystrokes or debugging time than proving things about my algorithm before I code it, and I know this comes from math because my CS-only friends can't do it . I don't care if you want to go in to algorithm theory or get a software job at a bank, if you're a CS major,…

[deleted]

Re: Security is Mathematics

#38

Post by cperciva »

danielparks wrote: post #36
chwahoo wrote: post #30

Where the author's narrative breaks down is when he draws a parallel between security and proofs of theorems . The closer connection is between security and adequacy of theorems. It is true that you need to make sure your software conforms to its specifications and that process does involve informal (or formal) proof-like reasoning, but that is only a small part of the challenge. This is the part that mathematicians…

Obviously I can’t speak for Colin Percival, but I think that the point of the article is quite a bit simpler: I read this as saying that the mindset required to write proofs is similar to the mindset required to write secure software. The proof mindset is useful for considering “all the real-world ways that things could go wrong.” I think the paragraphs about Knuth’s famous quote just muddy the water.

the mindset required to write proofs is similar to the mindset required to write secure software

Bingo.

Re: Security is Mathematics

#39

Post by cperciva »

tptacek wrote: post #28
cperciva wrote: post #25

Earlier quoted context omitted.

Charlie Miller You mean the Charlie Miller who has a PhD in mathematics, right? Also, did you seriously just write a list of top-tier security researchers which didn't include djb?

I didn't know Charlie had a math degree! That's two. :) Rolf Rolles is more of a security researcher --- a lot more --- than Daniel Bernstein. But I'll concede it! He's a third. We're at 3. Do you think I can't name 10 more notable security researchers, justifying each of them, to back up my point here?

Rolf Rolles is more of a security researcher than Daniel Bernstein

I think we'll have to agree to disagree here. But given our different focuses in security, it's not all that surprising that we have different definitions of "security researcher".

Re: Security is Mathematics

#40

Post by stcredzero »

barrkel wrote: post #31
Tycho wrote: post #22

Earlier quoted context omitted.

Can you elaborate on the economics involved, please? Sounds interesting.

Economics is about the study of choice, at a deep level: the study of choice under conditions of scarcity, or with constraints (a definition like that is in most introductory textbooks). It's almost like psychology applied to crowds of interacting agents. (Some people seem to get the idea economics is like accounting but vaguer, like a climatologist is to a weatherman or something. Macro economics is the bit that get…

One example: The universal truth of "DRM Doesn't Work" actually simply means "DRM isn't strong enough to for big companies to stand up to the ravenous appetites of everyone on the entire internet."

This is why big companies with content everyone craves have such a hard time with DRM -- there's just too much firepower arrayed against them. If you look closer, you find that "DRM Doesn't Work" isn't quite true. It's just not as strong as Phillips or Sony would like it to be.

Post reply on HN