Live data from Hacker News

Nobody Cares About Security

adatosystems.com

31–40 of 93 posts

Re: Nobody Cares About Security

#31

Software security is the absence of vulnerabilities, which is a special case of the absence of bugs. People are not interested in security because they are not interested in quality. Even those environments that are supposed to be high security, are in fact buggy, slow and very frustrating to use - revealing that they are almost certainly riddled with vulnerabilities as well. It's implausible that a system could be s…

"Software security is the absence of vulnerabilities"

I must disagree. a vulnerability where a threat actor has no way of exploiting it in the real world is not a security issue. On the flip side, a software that magically lacks any vulnerability in its code can still have design issues like bad UX or easy to misconfigure (is it elastic's fault when people expose their elastic db to the internet for example).

In the software dev world, there is this view that security is absolute. in reality, it is very much relative to the data and real-world threat. Since software devs aren't expected to know details about current threats, they're expected to think in terms of absolute and hypothetical scenarios. Which is great for writing software,but when evaluating or discussing security (software or otherwise), it's not about how many vulnerabilities there are, it is about data vs threat actors and how that risk impacts you.

Re: Nobody Cares About Security

#32
There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia.

Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certificates, algorithms, cipher suites, domain names (for some reason). Cue the people who have traded some of their valuable time to memorize this trivia showing up to defend TLS and how simple it is. They remark that anyone who hasn't memorized this trivia "isn't a security expert".

Contrast that to something like Wireguard. There are keys, one is private, and I swap the public ones. Simple as that. If the only way to connect two processes was to transfer a string `@` between them, think about how many problems would be avoided, and how many fewer security "experts" the industry would need.

Re: Nobody Cares About Security

#34

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

Sure, now you just need a way to validate the public key and IP address genuinely belongs to the claimed identity. Could use a certificate?

Re: Nobody Cares About Security

#35

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

[deleted]

Re: Nobody Cares About Security

#37
post #5

Surprisingly few companies (or people) care about paying for good security.

This is just a specific case of the general problem of long-term, cultivated, or difficult-to-measure goods. Who gets more recognition or reward, the guy who hardened his software over time to prevent the bug, or the guy who swoops in to fix the bug? The guy who tested his code to prevent bugs, or the 10x rOcKsTaR who shat out a mess of an app that appears to do what it should, but leaves everyone else cleaning up the disaster later?

Our culture in particular excels at implementing this bias.

Re: Nobody Cares About Security

#38

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

Sure, now you just need a way to validate the public key and IP address genuinely belongs to the claimed identity. Could use a certificate?

The IP address is just a hint in that example because we don't yet have robust identity based networking. It's actually meaningless, either I successfully authenticate with the public key on the other end, or I don't. I don't care about getting the wrong IP address, worst thing that could happen is that I bother the wrong process and it can't establish a connection with me.

You must be a TLS expert because saying we need to check if a public key "belongs to the claimed identity" is creating a problem where none exists. The public key is an identity, that's who I want to connect to. In the Wireguard example, it really is that easy.

Re: Nobody Cares About Security

#39

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

The weirdest part about TLS is how a non standardized format (PEM) has become the defacto standard and is the leading cause of complexity in setting up TLS. Certbot doesn't support PKCS12, which is the actual standard format. So you have to put an extra step in-between certbot and your application.

Re: Nobody Cares About Security

#40

Earlier quoted context omitted.

Sure, now you just need a way to validate the public key and IP address genuinely belongs to the claimed identity. Could use a certificate?

The IP address is just a hint in that example because we don't yet have robust identity based networking. It's actually meaningless, either I successfully authenticate with the public key on the other end, or I don't. I don't care about getting the wrong IP address, worst thing that could happen is that I bother the wrong process and it can't establish a connection with me. You must be a TLS expert because saying we…

I think man in the middle attacks are the concern. But still better than plaintext.
Post reply on HN