Sorry guy who wrote this article in 2005, hacking is definitely cool.
The six dumbest ideas in computer security (2005)
81–90 of 216 posts
Re: The six dumbest ideas in computer security (2005)
#82I wonder how well we all think this article has aged? "Penetrate and Patch" is supposedly dumb. But what do we practically do with that? We've seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what's there to do but patch it? If some software has never had a bug found…
I think this article has aged very well. > Also web browsers face a constant stream of security issues. What are we supposed to do instead? There's not much that users can do, but web browsers have spent the last decade moving away from "Penetrate and Patch" to much more proactive approaches. Eg, Chrome pioneered moving each tab to a separate process with full sandbox isolation. Firefox is talking about using webasse…
> The first time you see dialogues asking "Do you allow this app to open files in your Documents folder" its sort of annoying, but its a fantastic idea.
It’s not a great idea because it’s annoying. It is not really useful in its current incarnation to most people.
Re: The six dumbest ideas in computer security (2005)
#83>Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb? Sure, but how does one get the knowledge on how to secure systems? Half the job of a security engineer is thinking like an attacker and trying to poke holes in it. Key mitigations like ASLR and stack canaries are so effective because they specifically block off key re…
With respect to this example, I think he is saying it would be better if we were using memory safe languages, rather than trying to come up with these sorts of mitigations (which is enumerating the bad). Of course it’s probably not possible in every scenario because we’ve been doing it badly for so long, but I think the principle still holds.
Of course we can avoid all the lasting architecture mistakes we made if we knew it before and had been doing it correctly since the beginning.
And it's practical, right? Right?
See, when there are no "system security" word on it people suddenly start to make sense of it.
I'm glad that we are reviewing this 2005 post in 2023 though, at least we can fight hindsight by hindsight.
Re: The six dumbest ideas in computer security (2005)
#84> Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?
How can you engineer a good lock without investing all the ways it can be bypassed by lockpicking lawyer?
Re: The six dumbest ideas in computer security (2005)
#85> My prediction is that the "Hacking is Cool" dumb idea will be a dead idea in the next 10 years.
That didn't age well. In the era of growing corruption in government and business alike hacking becomes important way through which people can actually learn anything about their overlord's shady deals.
Re: The six dumbest ideas in computer security (2005)
#86> My prediction is that in 10 years users that need education will be out of the high-tech workforce entirely, or will be self-training at home in order to stay competitive in the job market. My guess is that this will extend to knowing not to open weird attachments from strangers.
And yet, just yesterday I've seen a TV ad explaining how to not get phished out of your money through your banking app.
I think it a running theme in this document that author displays severe lack of understanding how security becomes hard as soon as you let anyone do anything online.
Re: The six dumbest ideas in computer security (2005)
#87Earlier quoted context omitted.
Maybe I'm being too harsh, but my interpretation of that point is that they expect we'll eventually become perfect, which isn't going to happen in the software world as it hasn't happened in the airline world, even though the airline world has more incentives to be perfect in the form of more penalties when it isn't.
My understanding is the author suggestion is to start with a security first approach, rather than wait-and-fix. They don't expect the airline to be infallible, but they expect the airline to be proactively avoiding trouble.
The most secure plane is the one that stays on the ground.
It's always point of contention between people with security mindset and people that need to earn money to even hire people with security mindset.
Re: The six dumbest ideas in computer security (2005)
#88> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…
> "We can't stop the occasional problem" - yes, you can. All those tools (checklists, redundancies, etc) exist to increase the reliability rate. And to stop the occasional problem (ground crew forgets to refuel plane) from turning into a disaster[1]. I might be overly generous, but thats my read of the author's intent. That just like in the airline industry, we have tools to stop occasional problems from turning into…
> checklists, redundancies
These things are created and extended because occasional problems happened.
Re: The six dumbest ideas in computer security (2005)
#89A reminder that a big part of the subtext of this piece is a reactionary movement against vulnerability research that Ranum was at the vanguard of. Along with Schneier, Ranum spent a lot of energy railing against people who found and exploited vulnerabilities (as you can see from items #2, #3, and #4). It hasn't aged well. I'm not sure there's anything true on this list that is, in 2023, interesting; maybe you could…
What was the argument against vuln research? The 'Penetrate & Patch' bit makes it sound it's something like 'this is pointless because the proper way to fix this stuff is better design and other things are a waste of time and effort'.
Re: The six dumbest ideas in computer security (2005)
#90> My prediction is that in 10 years users that need education will be out of the high-tech workforce entirely, or will be self-training at home in order to stay competitive in the job market. My guess is that this will extend to knowing not to open weird attachments from strangers. And yet, just yesterday I've seen a TV ad explaining how to not get phished out of your money through your banking app. I think it a runn…
Only last week, I saw someone post on Slack:
> I got an email from [CEO] asking me to read a Word doc. I thought it might be a dodgy email so I checked the attachment..."