91–100 of 167 posts
Earlier quoted context omitted.
I agree about C and C++, but is there a language that exists today that you think would be better for writing security-conscious code? Should a language be invented that is specifically for writing security-conscious code?
Rust, for the former, Cryptol for the latter (just one caveat: written by the NSA/influenced people).
Earlier quoted context omitted.
Oh, the whole cyberwar situation is far from "hopeless". The truth is nobody to speak of has taken it seriously yet. Security is still mostly an afterthought, if that , almost everywhere you look. Even in nominally security-focused contexts. And much of the activity in places that really are security focused are built around an environment in which software must be assumed to basically be constructed out of styrofoam…
> Security is still mostly an afterthought, if that, almost everywhere you look... yes, this will require immense effort. What I keep thinking, though, is, what would be the total dollar cost to make security a forethought, with information technology being pretty ubiquitous? I think it might actually have serious economic impact -- is it possible we literally can't afford security, as a society?
Earlier quoted context omitted.
> Security is still mostly an afterthought, if that, almost everywhere you look... yes, this will require immense effort. What I keep thinking, though, is, what would be the total dollar cost to make security a forethought, with information technology being pretty ubiquitous? I think it might actually have serious economic impact -- is it possible we literally can't afford security, as a society?
I think we could, because once we started down the path of taking security seriously, we would get better at it. What you see now is largely us not even trying. Well, just barely trying, maybe; not trying at all was the 70s. But there's still too many places where 'industry best practice' is insecure, and where even on places like HN you'll get serious fights over whether or not strong typing or even languages that p…
Earlier quoted context omitted.
If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI
it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…
Earlier quoted context omitted.
Your comment is indicative of the crisis of legitimacy that has infected our governments, and most of the institutions of stability in our global society. It seems like a small thing; but once the perception that the forces of law and order are themselves lawless exceeds a certain critical threshold things begin to change rapidly. Indeed the United States itself came to be in the wake of the erosion of the legitimacy…
I'd love to see some historical basis for this supposition that there is a natural counter balance to "lawless" power. First of all, your premise presupposes that there is some standard of "lawfulness" against which the existing power structure can be judged. If the powers that be are faithful to their own interests and rules then by definition they are lawful, since they create and administer the law. Your appeal to…
Earlier quoted context omitted.
If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI
it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…
Earlier quoted context omitted.
If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI
it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…
Earlier quoted context omitted.
Your comment is indicative of the crisis of legitimacy that has infected our governments, and most of the institutions of stability in our global society. It seems like a small thing; but once the perception that the forces of law and order are themselves lawless exceeds a certain critical threshold things begin to change rapidly. Indeed the United States itself came to be in the wake of the erosion of the legitimacy…
I'd love to see some historical basis for this supposition that there is a natural counter balance to "lawless" power. First of all, your premise presupposes that there is some standard of "lawfulness" against which the existing power structure can be judged. If the powers that be are faithful to their own interests and rules then by definition they are lawful, since they create and administer the law. Your appeal to…
So you're right to point out that there is no "threshold" as stated by the OP, however the frenzy with which the US government is undermining its own legitimacy as well as that of many other Western governments, does not bode well for our civilization (Western or otherwise).
Earlier quoted context omitted.
Your comment is indicative of the crisis of legitimacy that has infected our governments, and most of the institutions of stability in our global society. It seems like a small thing; but once the perception that the forces of law and order are themselves lawless exceeds a certain critical threshold things begin to change rapidly. Indeed the United States itself came to be in the wake of the erosion of the legitimacy…
I'd love to see some historical basis for this supposition that there is a natural counter balance to "lawless" power. First of all, your premise presupposes that there is some standard of "lawfulness" against which the existing power structure can be judged. If the powers that be are faithful to their own interests and rules then by definition they are lawful, since they create and administer the law. Your appeal to…
Map political science onto the sandpile model [1] to get a first order approximation of the framework of analysis I'm using from a macro perspective. On the micro level of individual perception; what matters isn't merely the perceived lawlessness of the elites and of the guardian castes, but the growing sense that "If you play by the rules; you're a sucker." And depending on your level of investment in the current order that sense can be a powerful motivator to working around limits that were introduced to promote institutional stability.
And if most peoples reality is that the ruleset they're working off of is largely economically workable only because it's technically illegal... that's inherently unstable.
Earlier quoted context omitted.
I think we could, because once we started down the path of taking security seriously, we would get better at it. What you see now is largely us not even trying. Well, just barely trying, maybe; not trying at all was the 70s. But there's still too many places where 'industry best practice' is insecure, and where even on places like HN you'll get serious fights over whether or not strong typing or even languages that p…
That's the thing. I know this is sacrilegious to say, but I wonder if the efficiency bonus from computerization really is so great, or would be, if it wasn't built on a pile of crap.
We'd definitely still be using mechanical computers. But I could easily see lots of eye candy being stripped out to conserve cycles (after all, having a 3D desktop on a Pi isn't all that useful :)