Ask Slashdot: Is the World Better Or Worse Because of Security Tech?

Slashdot reader krisdickie is a developer for embedded devices (and many other systems), and spends a lot of time being proactive about security. This is obviously important, and I don't necessarily see it as a distraction, but rather a complex problem that has some added thrill to being solved. I can't help but wonder though if I (and my team) would have been X times more productive or have come up with some amazing new concept or feature, if we didn't have to deal with implementing security measures.

In a utopian world, where there are no bad actors, we would have likely forfeited many of the systems and ideas that have been put into place to prevent bad things from happening. So my question is -- are we more technically advanced because of the thoughtfulness that has gone into creating these systems?

Or are we just losing precious resources and time dealing with the necessity of protecting ourselves from the perilous few?
Share your own thoughts in the comments. Is the world better or worse off because of our ongoing development of security tech?

Comments

Seriously?

[RobbieCrash]

What an asinine question.

Of course we're worse off because there are bad people in the world. If everyone was a magical completely altruistic person who did nothing but make the world a better place, the world would be a better place.

Re:Seriously?

[Jeremiah Cornelius]

This article touches on many of the overall issues, implicit in the "question", as it is.

"It’s time to kill the web"
https://blog.plan99.net/its-ti...

Re:Seriously?

[jellomizer]

Security and Convince have always been at odds.
Now new security tech does help make some things a bit more convent while keeping a reasonable (not superior) degree of security.
Such as biometrics like finger print reading and face recognition allow you to keep devices secure enough against the casual bad actor ( the majority of them ). As well with the advancements in encryption allows a lot of extra security to go on without much user interaction. But still it isn't faster and easier to use these system with all the security turned off.
Now one of the big issues that I see today are two groups of thought.
One group who doesn't pay attention to security at all: Either they don't understand or don't care of the impact to everyone else about the security of their devices and products. Normally their reasoning is why would anyone would want to hack me, or hack such a device. Not realizing any hack gets you a bit further into a network which could open the door for further intrusions.
The second group who thinks there stuff is more valuable for what it actually is: Here too much resources are put into fixing the issue. Too much productivity is loss and time spent protecting data that isn't worth the expense. This makes the data so difficult to get that it isn't worth keeping. And often with this group they will look at the millions of dollars they put into security and often forget a tiny hole which still doesn't make them fully safe.

The problem with the internet isn't that they are more bad people then before, but the bad people can hit more targets at once for less effort. A burger in the 1980's may be able to break in to a couple of houses a night, at great risk, perhaps getting enough goods to support him for a week or month. Today on the internet you can try to break into millions of computers a day (And normally make the same amount of money) with less chance of getting caught, or getting attack by a dog, or an armed neighbor.

Security tech makes it worse, but only because the bad guys are being more insidious.

Re:Seriously?

[Sique]

This mostly misses the point. Security is much more than protection against bad people. This might be a very visible and easily explained effect of having security, but security also protects against misshappenings, mistakes, accidents, errors, all the little nuisances which disrupt the intended way of running things. Even if all people were saints, we still would need security.

Re: Seriously?

[Immerman]

Oh, sure, I can imagine such a place - but that awasn't the proposition: a world full of truly selfish people would care for ONLY themselves. Meanwhile pretty much every social animal on the planet demonstrates compassion and altruism - without them we would probably never even manage to develop modern civilization in the first place.

Better or worse?

[Anonymous Coward]

Is the World Better Or Worse Because of Security Tech?

Yes.

Sure, just ignore security, YOU IDIOT

[Anonymous Coward]

admin/admin passwords, not rolling out patches, leaving anonymous FTP open... what can go wrong? this article was written by a dumbass

It depends

[walshy007]

This is not a one-case-fits-all item.

What kinds of measures specifically are being spoken of? Does it help or hinder end users doing what they wish? Are end users even a consideration or is this solely to keep a stranglehold on the device from a manufacturers perspective?

As with many things there will never be a single answer, what is presented is a set of varying trade-offs whose value will change depending on the desired goals and whose perspective it is desired from.

Necessity is the mother of invention

[Kobun]

Human 'bad actors' are only one source of adverse conditions for computing. Many security features double as stability and error-checking features. I think that the author's question is ultimately a silly one because of Hanlon's Razor - "Never attribute to malice that which is adequately explained by stupidity". I think most people have seen terrifically destructive users who had no malicious intent behind their actions. Even in a utopia, humans are still human.

Re:Necessity is the mother of invention

[Calydor]

A good example would be the Melissa virus which, IIRC, started out as a proof-of-concept that accidentally got loose.

Missing Option

[dohzer]

Not better or worse, but as it should be.

I'd - sadly - say better.

[GerryGilmore]

Sadly, because we, somehow, have allowed this great infrastructure we call "the internet" to be as filled with (security) holes as a collander.

At this point, we re just imitating the Dutch boy quickly plugging holes in the dike while at the same time realizing that we'll run out of fingers long before all of the holes are plugged.

Re:I'd - sadly - say better.

[dgatwood]

It's not even that. The answer to the question of whether security makes things better or not in general is straightforward: It depends on whether the cost of the security is enough of a nuisance to exceed the projected lifetime benefit. And that largely depends on context. I'll explain by analogy.

I grew up in a small town in West Tennessee. Lots of folks around town routinely left their houses unlocked. It was that kind of town. There were a few thousand people, and everybody knew everybody, or if they didn't know somebody, they knew someone who did. In that context, it didn't take much security to keep things safe, because most people are good people, and if somebody from outside the community was wandering around, everybody knew that the person was an outsider if nobody out of a group of three or more people recognized the person. Thus, a bad person from elsewhere would arouse enough suspicion to be noticed, and would probably be thwarted in whatever nefarious deeds he or she was planning, unless it was just minor mischief like TPing the house of somebody that nobody really liked much anyway.

Now, I live in the Silicon Valley. I know two of my neighbors. Thanks to work and church, I know people from various parts of the area, but they don't live nearby I'm reasonably confident in leaving things lying around at work for precisely the same reason that I was reasonably confident back home—because everybody knows each other. But if you were to ask me if I could leave valuables lying around anywhere else, the answer would be "heck no," because nobody knows anybody, statistically speaking, and so everybody is indistinguishable from a potential insider or outsider. Even though most people are still good people, the odds of a bad person getting noticed are much lower. And with so many more people, the number of bad people is much higher even if the percentage is the same, which only compounds the problem.

The same problem exists with technology. Prior to the Internet, when computers were basically devices that you interacted with locally, security didn't matter that much, because most people are good people. When computers became more connected, that became a problem, because even if most people are good people, the bad people can get to your systems from anywhere in the world, so it only takes a few bad people to ruin everything. And because the pool of people potentially accessing your system is so much larger, the ability to distinguish good people from bad people is diminished.

So to make a long story short, computer security is a necessary response to the realities of a more interconnected world. Would things be worse without all that added security? Yes. Does the security actually make the world better? No. It just keeps things from unraveling in the presence of interconnectedness that does make the world better. The real question is whether that distinction matters.

Technology is a gift

[MrKaos]

The choice people have to make is if it frees us or enslaves us.

We had our decision point in the 80s and 90s

[ctilsie242]

In the 1980s and 1990s, there was a turning point where security was considered something that should be baked into an OS and product, be it an operating system (thus the C2/C3/B1/etc. levels), MAC/DAC controls, security as part of the kernel, and part of a module, and so on.

However, what happened is that companies took the easy route. Windows had no innate security so the whole firewall/castle model of company security was formed, where security was done by the network fabric, and not the endpoints. This worked for a while, until malvertising and Trojans allowed malware to attack anywhere.

These days, security is pathetic in general. I have heard "security has no ROI", "the hackers will always win, so why waste money?" and other claptrap for over a decade. In fact, because there is no real criminal penalty, an egregious security breach makes the top levels of a company a lot of money because they can short their stock before making the announcement public, especially if they can keep the breach under wraps for six months.

IoT devices come to mind as a specific example. Why even bother with meaningful security when customers are forced to buy your version 1.1 of a doodad because version 1.0 will get their stuff hacked, and cannot be upgraded? Especially because the money with IoT is the analytics coming in, not the actual purchase of the device.

Re:We had our decision point in the 80s and 90s

[Alypius]

It's stuff like this that makes me cry, but only because it's true. It actually makes me second-guess my second career; do I take my risk analysis and other skills to a company that will ignore it because "the hackers will always win," or do I go for a NSA gig where I can actually be on the offensive for once?

Re:We had our decision point in the 80s and 90s

[ka9dgx]

In the 1980s and 1990s, there was a turning point where security was considered something that should be baked into an OS and product, be it an operating system (thus the C2/C3/B1/etc. levels), MAC/DAC controls, security as part of the kernel, and part of a module, and so on.

However, what happened is that companies took the easy route.

Amen! However, also along the way is that the entire tech community decided that real security wasn't possible, it somehow became unobtainable. The problems were SOLVED in the 1970s in response to the data processing problems encountered with multi-level data security for Viet Nam, but we failed to heed the lessons, and eventually they fell into obscurity.

Capability based security offers a way to have general purpose computing that humans can manage and secure. The core concept is to never, ever, trust any piece of code outside of the kernel of the OS. When a user needs to access a file, the application requests the OS to prompt the User for it, and is handed back a capability (like a file handing in Linux) to that specific file only.(As opposed to the current model of trusting the program to do only what it is supposed to do, and to never have a bug, or make a mistake) As far as users are concerned, it doesn't seem much different from any other system, the dialog boxes might look slightly different, but as far as the application, it can only access the specific stuff the user has decided to trust it with, and nothing else.

It's possible to have secure computing, but it's been a long time coming. GNU Hurd stalled out, Microsoft Midori stalled out, the only glimmer of hope I've seen lately is the Genode project, which might be something we can get to run in the next year or two. I estimate 10 more years before Capability Based Systems go mainstream.

Re:We had our decision point in the 80s and 90s

[dnaumov]

People can't deal with trivial UAC prompts because they don't understand what's being asked of them and you are suggesting THIS?

Re:We had our decision point in the 80s and 90s

[ka9dgx]

UAC suck, quite frankly. It's a "this might be bad, do you want to do it anyway" type of question, conveying no useful information other than horrid boolean choice (Yes - your machine might get PWND along with everything on it, No - Your machine won't do what you want because of "Security")

Replacing dialog boxes with "power boxes" makes almost no difference in terms of ease of use, but it shifts permissions away from the application code and puts it back where it belongs.

Insisting that users can't manage their own computers because of stupid OS design choices is like insisting that people can't handle wallets and cash money because of the fact that Armored cars might occasionally have faulty doors which leave money flying across Indianapolis.

When you have cash money, you only hand the clerk the amount necessary to pay the bill.... the current OS design would have you hand your wallet (and a non-revocable power of attorney) to the clerk, and just hope that they take the right amount out of your account before handing it back.

Better, more transparent, easier to use, security is possible.

Re:We had our decision point in the 80s and 90s

[Anonymous Coward]

The OS file dialogue is exactly how OS X handles sandbox applications for opening a file.
It goes further, that it gives a file handle back that is signed by the OS, so it can store the user-given-permission in a preference file, so that the next time the application is opened it will still have access to that file.

Re:We had our decision point in the 80s and 90s

[110010001000]

Ridiculous. A computer program can "touch" many files and also may need to run without user intervention. No one is going to answer "yes this problem needs to access djfhgkl.dll" prompts. General computers can never be secure because malware are just programs too.

Re: We had our decision point in the 80s and 90s

[Arnold Reinhold]

A big factor was U.S. export controls. An operating system with strong security would require individual licenses to be sold in other countries. Remember 40-bit encryption keys?

Re:We had our decision point in the 80s and 90s

[ka9dgx]

Why should a program even know about the existence of "djfhgkl.dll"? It shouldn't see any of the file system, except when handed a capability for a file or folder.

Every gas station clerk I hand $20 to as a form of payment doesn't have the ability to take out a mortgage in my name... they only have the $20. There are zero clerks asking to touch each note in my wallet by serial number, etc.

Malware are just programs that are written to do evil, everything else does evil by mistake. Capabilities just prevent most of the evil as a class.

Re: We had our decision point in the 80s and 90s

[Bert64]

No it doesn't.
There are thousands of compromised boxes in china, and malware infections are a routine problem in chinese companies.
A lot of the spam and hack attempts that come from chinese addresses aren't launched by the chinese, they are boxes that have been hacked.

Re:We had our decision point in the 80s and 90s

[Bert64]

the current OS design would have you hand your wallet (and a non-revocable power of attorney) to the clerk, and just hope that they take the right amount out of your account before handing it back.

Which is exactly how credit/debit cards work...

Re:We had our decision point in the 80s and 90s

[avandesande]

Yeah, when an OS was the size of what is now a simple device driver.

probaby yes

[superwiz]

It probably increases usability in the same way that car safety measures increase usability of cars. As someone already mentioned, it forces systems to be designed in such a way that they are also proofed against users "shooting themselves in the foot" at a moment of even a tiniest incompetence.

Locked Doors Are Barriers to Experimenting/Learnin

[Bing Tsher E]

I know that when I first started hacking around with Linux in the mid 1990s that I had an easy time experimenting with networking compared to somebody just trying things out today.

Samba was out and all the security in it, and in Microsoft products that used SMB, were loose and easy to use. NFS was a breeze to use, so you could boot up a machine with an NFS install floppy diskette and put a whole freenix (I like NetBSD) on a system quickly.

A lot of that has changed now. It's even a hassle now just to get two 'doze computers to talk to each other's shares these days. This is bad when it's a closed network and finding the server drive or accessing the printer is no longer just a matter of clicking the 'Network Neighborhood' icon on the desktop.
Security is, obviously, necessary. But my way of thinking is that the security should be incorporated at gateways. Home networks should be protected by hardened gateways and firewall appliances. People should have traffic monitoring equipment built into their local networks. Gateways to the 'whole internet' are usually done through NAT these days, so security should be lax within local networks and tight at points where they connect to the world.

Security only matters when there is an intruder about. I live in an area where if I forget my tablet out on the back porch it will always be there the next morning. The most risky intruders are coyotes out in the field.

Simple answer: Yes.

[Anonymous Coward]

Aka "both". But by and large, worse, and this will worsen until we fix two things:

The atrocious state of our technology, IOW the "hyoooooooge" technical debt. That mountain is so big we don't know where to start looking at it. But it's still there. It's become so big it has its own abyss, staring at you. That makes it even harder to look at.

Our willingness to be oppressed by technology. It doesn't matter if it's because of some "security" threat or other ("for the childrun", "terrists", you name it), government convenience (e.g. face recognition, not just China but the US and Europe already as well, but also SSNs and many other tricks, many seemingly innocuous), "user friendlyness" (yes, think about that one for a bit), faux-"security" ("secure boot" isn't about security), or any other reason. It always comes down to "who is in control?" and if it's not you, it's someone else. And if it's someone else, then the tech doesn't exist to empower you, but to empower them and by extension it becomes a temptation to use it against you, IOW a tool of oppression waiting to happen. Not because of any ideology, but because it's there, it's easy to use, it's powerful, and power corrupts.

So yeah, by and large the net effect is negative, will remain negative for the time being, and the people to do something about it, well, that's squarely us. So get to it, you slackers.

Yes.

[Anonymous Coward]

The logical value of (A or (not A)) is always True.

I am simplifying somewhat here because "better" is not the opposite of "worse" (we must also consider "equal"), however the probability of the situation being exactly equal is zero, so you get the same result.

You could also ask if it is better AND worse, and the answer would still be yes. Just as you could say Slashdot is both bad and good. There are plenty annoyances, but hey - after 20+ years I am still here reading, so it can't be all bad.

Some of these polarizing yes-or-no questions are just dumb.

Security Tech and the Orwellian society

[MindPrison]

First we have to ask ourselves, what is security?

Security, as in locked doors, encrypted drives, encrypted mail and digital wallets?

Or...

Security as in personal security (the rights to roam free and pursue our own dreams), free from oppressors, freedom of speech, information freedom.
In a time of fake news where it's possible to manipulate another country just by doctoring the news and opinions of the masses, this is certainly not good.
Another bad is that if we take away our freedom of speech, we get less say - and the power handed to a privileged few, aka "your" chosen government.

Internet gave us a lot of freedom. We could exchange information faster than ever before, play games with our friends overseas, book travels and earn money no matter were you where in the world.

But it also blinded us, with information this fast, there was no time for peer reviews of the news, what source can you truly trust? "Likes" almost became the new "law". Getting likes was almost like the new religion, and nevermind the reliability of the actual sources, just as long as a bunch of likes came along, and the rest thought "meh...might as well join the crowd", and what crowd? These are just numbers. A very real but dangerous development.

Time to take a step back - and understand that we should keep this technology free, putting too many locks on it also censors our freedom of speech, but security starts with us, we need to educate ourselves and not trust everything blindly. Turn off the net, breathe - go out there, say hi to your neighbor once in a while, talk amongst yourselves.

Re:Security Tech and the Orwellian society

[UnknownSoldier]

> "Likes" almost became the new "law".

The Orville even did an episode on that: Majority Rule (aired in 2017) which was a repeat of a Black Mirror episode Nosedive (aired in 2016), which is similar to a Community, App Development and Condiments (aired in 2014)

It's actually worse then that. Security (or the lack of it) -- whether it be public security (prevention of intrusion) or personal security (protecting your rights) -- can be summarized with two phrases and how they are linked:

1. Follow the money, and
2. Rise of Good Enough aka Worse is better

This gives the TL:DR; conclusions;

Security can be measured short-term or long-term,
Security is only a means to an end.

That is, for most companies there is (almost) no long-term financial gain but there is a real short-term expense if you take security serious

For example:

* Banks have a lot more to lose if they don't take security serious -- both short term and long term.
* Some fly-by-night company may lose short-term (expense), but long term no real benefit if they ignore security.

Let's take a hypothetical case of 2 companies, working on products that have identical features:

Company A = Does the bare MVP (Minimal Viable Product), security issues are largely ignored, or just barely acknowledged. Security is "good enough".
Company B = Takes security serious. There code is battle hardened against Fuzz testing.

Company A takes 12 months of development before they ship.
Company B takes 24 months of development before they ship.

Q. Which product is going to be more (financially) successful?
A. Company's A.

Q. Why?
A. The public does not value security -- they don't know how to. Let's pretend there is a buffer overflow problem that company A ignored but company B fixed. What is the probability of it actually happening? Company A said the ratio of risk:expense wasn't worth it while company B valued it.

We saw this _exact_ same thing happen in early Operating Systems when they moved from being single-tasking to multi-tasking would allow programs to stomp over another applications memory. This was inconvenient so eventually hardware was developed to stop this following the Separation of Concerns philosophy. Even today there are good reasons why a program would want to read another process's memory (debugger, automation), and there are bad reasons (malware).

Security is only a means to an end.

This raises the question:

* How do you prioritize security issues?
* How do you make sure everyone values security issues?
* How do we make sure bad security practices are made a priority and fixed?
* How are companies that use bad security practices punished?
* When security gets in the way of functionality / performance what needs to change?

If security issues were prioritized over functionality almost NOTHING would ever ship.

Where is the line drawn between idealism and pragmatism?

Security not being taken serious has created all sorts of opportunities to be hacked. We can certainly do better in this area. Education is the key.

Mis-allocated energies

[ka9dgx]

Time spent protecting operating systems from possible bad behaviour of applications is time wasted.

The current state of Operating Systems is akin to having only single phase AC power, but no fuses or circuit breakers anywhere in the system. Because applications are trusted with everything, any bug can result in the wholesale mis-direction of everything down the wrong path. Most (but not all) of our problems with security result from this misplaced trust.

It's probably going to be another decade before capability based security becomes mainstream, but I hope discussions of it in places like ../ can help bring it forward sooner.

Re: Mis-allocated energies

[Bing Tsher E]

The current state of things is like having fuses designed into equipment, but then finding that somebody has shoved a 30 amp fuse into the holder. I find that from time to time now on equipment I am repairing. Sometimes it causes dramatic equipment failure.

Re:Locked Doors Are Barriers to Experimenting/Lear

[zynthaxx]

The problem is that the intruder doesnâ(TM)t have to come from outside, but most likely will be a naive user on your own network who clicks something they shouldnâ(TM)t have on a poorly secured computer. So: The basic protocols are still around, so you can still learn the basics of how to set up network services within a lab environment; nothing has really changed there. But donâ(TM)t stop learning once you know the basics; thatâ(TM)s the main lesson here. When you can reliably create a file share, learn how to manage user accounts and groups, and how to apply the principle of least necessary privilege.

Security is a side effect of good code..

[zynthaxx]

Security mainly boils down to âthink about the consequences before implementing somethingâ, and âclean up your own mess to avoid introducing accidental consequencesâ. If a developer lacks these habits, they will write broken software from more perspectives than just security.

Re: Security is a side effect of good code..

[krisdickie]

This is the type of concept I was thinking about in asking the question and the point I was trying to touch on. More thoughtfulness, better code, better technology, happier people. But the answer 'yes', is also my favourite.

Better, but narrowly

[cfalcon]

Much of the internet is built on a model of reasonably open trust. This proved to not be a mistake, but a particularly galling one, which has required patch after patch.

The problem, as I see it, occurred starting in about the mid 90s. At this point, what the internet actually was, was clear to all. Making assumptions of trustworthiness in 1985 was still quite reasonable: it was possible that all meaningful internet connections were to continue to be monitored for bad behavior manually and actioned when appropriate. It wasn't what was happening, but it wasn't lunacy.

In the mid to late 90s, once the majority of the really gullible things were beaten out of everything, things appeared to be kinda looking up- we were at least on the correct trajectory. Queue another massive overdose of functionality. The early versions of IE would just run any link as appropriate. You could provide a link to C:\windows\notepad.exe, and clicking it would run notepad. Or a deltree on your C drive. Unix land, while not as degenerate, was still busy taking URLs as commands, browsing all over the root filesystem, and generally behaving like amateur hour. Every new tech that got added was riddled with security problems that were reasonable obvious, and they were still adopted at absolute lightning speed.

Technologies were obsoleted almost as fast as it took them to hammer out their bugs. The idea of passing code from server to client caught on, but unlike the prior iterations of this, there was no reason to actually TRUST the server- sure, you might trust microsoft.com, but do you trust $RANDOM_ADDRESS.net?

Something like SPECTRE wouldn't even be that interesting if the underlying assumption wasn't that you were downloading and running code everywhere you pointed a browser to.

The security overlay on all of this can be heavy at times. It is also frequently misguided, which makes much of the ire. See pretty much anything related to passwords for a great example of something that doesn't buy much security at the cost of a massive amount of usability (and goes backwards if it starts asking what school you went to, and then gives access to anyone who can guess that, a fact you cannot change). Even automated systems like SSL can ultimately be mangled by someone dedicated to the task.

Overall, much of the security burden is based around some bad choices early on, but almost everything that weighs us down now is a result of continuing to make bad choices.

Prevent bad things from happening

[blackhedd]

As a cybersec professional of many years tenure (and now an exec at one of the major firms), I have to admit I've asked this same question many many times. If we didn't need to put so much effort into security, and instead put it into features with direct customer benefits, wouldn't we all be better off?

I think the OP approaches the answer to his question when he refers to preventing bad things from happening. A basic part of engineering is system robustness, resiliency and safety. We don't question the effort we put into assuring those things. We manage, in a variety of ways, the potential impacts arising from possible system failures.

With cybersecurity, we manage in a variety of ways the potential impacts arising from system vulnerabilities exploitable by bad actors. It's work we'd be doing anyway.

anonymity

[bigtreeman]

anonymity and security,
can't have both
if criminals know they will be identified and caught they will be less likely to offend.

Re: anonymity

[Bing Tsher E]

There is something to be said for woeking at a really small company, or on a small team secured ay somewhere. Therw is far, far less anonymnity, but things are then looser and more free.

The place I am working has a 'news' bulletin that consists of a 'txt' file in a shared network folder. Everybody is expected to open and read and update it every day or so with notepad. The less computer adept have a shortcut to the file on their taskbar. It works because their are only 8 of us in the company. It's secure because only people on the network have access and the trust bond is in place because everybody knows each other.

There is anonymnity (so to speak, the last person to write the file is probably in the filesystem properties that a few of us know how to look at) but nobody cares, anonymnity is not needed. Race conditions could and do probably occur, so I personally always save changes I make immediately and would never add to anything but a freshly opened copy. Probably other people sometimes 'clobber' updates by changing and saving a stale copy, It's just a newsletter so there isn't really anything critical in it. It would certainly NOT scale to a larger group.

Java Anecdote

[Tablizer]

It's a rather open ended question, but here's an anecdote to consider. A lot of free and open-source software is written in Java. However, our security administrator set an aggressive policy on Java because of past Java security holes. Java-based applications run about 20x slower than they would without the aggressive scanning done on it by our security software. It makes such software virtually useless. We either pay more for alternatives or go without. (I personally believe the security scanning software that starts with an "M" is poorly designed, but that's another topic.)

I cannot reliably say if our org's policy is too aggressive, because not getting things done may be just as bad as being hacked in the longer run.

Another oddity is that Microsoft is also leaky, but because we need some software to avoid going back to paper and pencils, Microsoft gets a pass that Java doesn't. It's crazy. Sometimes it feels the 90's were more productive because we didn't have consider security stuff. (That and stupid Web "UI" (non) standards.)

Re:Java Anecdote

[DCFusor]

Doing without MS doesn't mean only paper and pencil as options....rilly? [sic]. I ditched windows around 2001 when I stopped running a company that fixed windows issues and wrote drivers for oddball hardware. There are around 20 machines here, mostly linux, a couple apple, all work great. Kinda diminishes any authority in the rest of your comment...

Re:Java Anecdote

[Tablizer]

I'm talking a big org. I don't control OS decisions.

Re:Java Anecdote

[DCFusor]

Gotcha. It's part of why I'd gone private-consultant.

Worse, IMHO

[Khyber]

Everyone has failed so hard at the first three levels of OSI through shitty programming that they rely upon several more layers of OSI to cover up for even shittier programming now.

Security comes through good programming practices, thorough testing, and sticking to KISS ideas.

Security as a pretext for surveillance

[SigmundFloyd]

The problem with security is that it's used as a pretext for surveillance and spying. We get backdoored CPUs so our data and devices are no longer under our control. All in the name of security.

I'll choose freedom over security any day.

What About Food?

[NicknameUnavailable]

This is obviously important, and I don't necessarily see it as a distraction, but rather a complex problem that has some added thrill to being solved. I can't help but wonder though if I (and my species) would have been X times more productive or have come up with some amazing new culture or technology, if we didn't have to deal with obtaining agricultural products.

In a utopian world, where there are no metabolic processes, we would have likely forfeited many of the farms and fisheries that have been put into place to prevent starvation from happening. So my question is -- are we more technically advanced because of the thoughtfulness that has gone into creating these systems?

Or are we just losing precious resources and time dealing with the necessity of fending off starvation?

Point being: OP is a euphoric tard. Security is a natural consequence of game theory, you might as well stop coding if you don't want to deal with it. It's no different than food or water for base survival - it's a result of existence.

Better off than with guns ...

[Qbertino]

... that's for sure.

https://youtu.be/0rR9IaXH1M0

In other news

[Hognoxious]

Cares would totally be much cheaper if we could make them from cardboard or something and like do away with brakes and all that shit.

Betteridge's law of headlines:

[thegarbz]

No. And in this case "no" means you really shouldn't be asking this kind of question. The world is not better or worse, a specific application is, a specific scenario is.

Re: Betteridge's law of headlines:

[krisdickie]

Hey c'mon, we're only here to discuss the big picture

Re:Locked Doors Are Barriers to Experimenting/Lear

[tlhIngan]

Exactly.

It's also making stuff harder to repair, because new vulnerabilities mean you lose the ability to fix it yourself.

Think about a fingerprint reader. In days gone by, they were simply cameras and you got an image from them, then run your algorithms on them. But nowadays it's such a big deal that fingerprint data must be encrypted and if your hardware supports it, sent over a secure bus to a secure processor, using PKI encryption to ensure both endpoints haven't been compromised.

All this because a bad actor can replace a fingerprint reader with a compromised version that perhaps either stores an image of a fingerprint for later replay attacks, or transmits it to a third party (via RF or other means - fingerprint readers are large chips). So now the device itself needs to tell the other end that it hasn't been changed out with a malicious version. But as we see, it breaks repairs - you cannot replace anything the fingerprint assembly is bound to anymore.

You're bound to see this with other things like recognition cameras, touch screens and other things eventually too. Touch screens and displays are next - soon you'd want authentication functionality done in a "secure mode" where the user OS no longer authenticates or locks the system - it simply calls out to a "secure OS" that verifies everything is in order (no security-critical hardware was been replaced or otherwise tampered with) then pops up the lock screen. And until the secure software releases the display and touchscreen, the user OS cannot display or get input. But again, it means break your screen, you need to get an authorized repair (can't have screens transmit everything you see to a third party, or selectively take screenshots when they recognize something being displayed).

And why would you do this? Well, it would make those grey box things no longer functional - if the secure OS has the screen and touch locked out, it makes it hard to break into the user OS - you're at the mercy of whatever the user OS may give you over that one port - without the code, the user OS can display a "do you trust this device" dialog that never can be shown or interacted with because the secure software has taken control of the display and touch hardware, and thus the user OS prevents access to user data.

All this means though, the inability to change screens.

Security measures and amazing new concepts or feat

[najajomo]

"I can't help but wonder though if I (and my team) would have been X times more productive or have come up with some amazing new concept or feature, if we didn't have to deal with implementing security measures."

No, security has to be baked in at the design stage and would have no deleterious effect on the implementation of amazing new concepts or features. It's patently obvious that in the rush to get out new features the innovators failed to come up with a design that can't tell the difference between executables and data and don't run executables downloaded over the Internet through opening an email attachment or clicking on a malicious URL.

Who are the perilous few?

[VikingNation]

There are plenty of non software products where designers must incorporate elements of design that to protect users. For example: durable goods, small appliances, bridges, stairs. Vehicles, etc. Software should be no different.

Utopia means NOWHERE

[drinkypoo]

And NOWHERE is there a lack of bad actors.

What a spectacularly stupid question.

Re: Utopia means NOWHERE

[krisdickie]

Rule #1 - you haven't failed to medicate

Re: Utopia means NOWHERE

[Bing Tsher E]

Utopia means never bothering to ask about those really old skeletons over there. Obviously reality self-corrected itself.

Re: Importance of human intel

[Bing Tsher E]

The places where shrill and paranoid 'high tech security' are mandatory tend to burn themselves up.

Over time, secure and well adjusted people will come along and build anew on the scortched patches of land.

Some would say that containment and provision of weapons and combustibles to the 'problem spots' is a sufficient means of correction.

Re: Gaming has more investment, more of a WASTE of

[Bert64]

Warner Bros and Disney will keep pumping out movies while the people who work on it are slowly drained of their time and wealth by the companies they work for, and the people who buy the worst of their products will keep producing "a market" for that slop.

Worse than that, disney keep selling the same movies again every few years, each time targeting new kids with the same old crap rather than making any effort to create any new content.

Re: Replacement for TCP/IP

[Bing Tsher E]

'More complex' can be the answer, but simplification also sometimes works.

Tearing out unneeded layers can improve security.

A piece of 'scorekeeping' equipment I work on for a sporting activity transmits to large displays for spectators and a judge's stand reciever . Originally I wondered why there wasn't more security in place, it just uses vanilla zigbee radio channels. Then I noticed that the communication protocol is simplex... and only the instrument that makes the actual measurement has transmit capability once the handshake has established a channel.

Re:Security measures and amazing new concepts or f

[ka9dgx]

NOTHING can tell the difference between
1> a program deliberately written to do something bad,
2> a program that does something bad by mistake

To make this determination requires solving the halting problem. You can not pre-determine the intent of a non-trivial program. This is the root cause of most computer security issues.

What you can do, is to pre-determine which side effects of running the program you are willing to allow. Most systems place NO limits on side effects of a program, however capability based systems do exactly this thing.

Re: Gaming has more investment, more of a WASTE o

[Immerman]

Bull. Music, art, dance, board games - these things exist in practically every culture in the the world, and have for at least several thousand years. Poverty is no great impediment to entertainment. Even in our hunter-gather days it's estimated that the average person only spent a few hours a day in survival-oriented activities. Abject poverty, along with the idea that anyone should spend more than half their waking life at work, are purely modern constructs of greed-oriented society.

Re: Gaming has more investment, more of a WASTE of

[Immerman]

Sure it's a timesink - but there's no need for constant labor, it'd be a complete waste. We could give every person on the planet adequate food, shelter, and medical care using only a small fraction of the current global productivity. After that, pretty much everything else is about either increasing future potential or entertainment.

Re: Gaming has more investment, more of a WASTE o

[pete6677]

The fact that you had time to post that waste-of-space comment of yours proves that you are one of the "pampered first worlders".

Scarcity thinking and ironies of abundance

[Paul Fernhout]

I agree with your point "computer security is a necessary response to the realities of a more interconnected world." That said, in many cases, I feel the deeper issue is, as in my sig, the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.

I write about those ironies in regards to militarism here: http://pdfernhout.net/recogniz...
"Likewise, even United States three-letter agencies like the NSA and the CIA, as well as their foreign counterparts, are becoming ironic institutions in many ways. Despite probably having more computing power per square foot than any other place in the world, they seem not to have thought much about the implications of all that computer power and organized information to transform the world into a place of abundance for all. Cheap computing makes possible just about cheap everything else, as does the ability to make better designs through shared computing."

But if we think about computer network security and bad actors, many (not all) bad actors are in it for the money. The ironic aspect is that the power of computing tools make is easy for a few people to make a lot of trouble for many people. So, a few people send spam email to make money for themselves which then makes it hard for others to use email to create abundance for all. Or a few people spam wikis to make money for themselves in turn making wikis harder to use by others to create abundance for all. Or a few people crack into other types of knowledge sharing sites again to make money for themselves making it harder for scientists and engineers to do collaborative work. Or a few people inject malware into ads to make money for themselves which makes it harder for other people to learn new information from the web they might use to build a better world.

These sorts of socially costly bad actions reflect a narrow view of self (selfishness) and/or also short-term thinking.

I just started reading Vernor Vinge's "Rainbow's End" novel that touches on some of these ideas of technology as an amplifier: https://en.wikipedia.org/wiki/...

I forget where I first read this, but an economist wrote that the cost of doing business goes up greatly when there is less trust. If we had to harden all the power lines and phone lines and then armor all our cars and bar all our windows and so on, daily life would get a lot more expensive. One can see those sorts of costs rising in places where social order breaks down.

In physical day-to-day dealings in, say, much of the USA or Western Europe, we don't worry too much about copper thieves stealing power lines or stealing phone lines or doing other similar sorts of behavior because there is a certain level of trust making relatively insecure installations possible. That level of trust has arisen from a level of shared abundance. Trust also comes indirectly because there are also laws (backed by police and courts), norms (backed by neighbors), and effort costs that discourage most people from being anti-social in such ways. Lessig in Code 2.0 writes on ways human behavior is shaped by a mix of such rules, norms, and prices.

Or, as in the example you provide, trust may be more feasible in smaller groups where everyone knows each other and can see fairly easily what is going on.

So, I can wonder if computer networks will not settle down until we have better laws, norms, and prices governing their use. That is harder given, as with "interconnected", the fact that human actions across networks typically cross multiple legal jurisdictions and cultures and identity of actors is often hard to assess. Broad trust on the internet encouraged by laws, norms, and prices may be harder to foster these days -- even though in the early days of the internet, where most internet nodes were academic or military or government and reflected institutional norms, and where network connectio

Re: Gaming has more investment, more of a WASTE o

[Anonymous Coward]

If only that were true.

A very small portion of global spending goes to entertainment.

Simple objectives don't meet simple methods to obtain them. You know how much time is wasted handling paper records? Well electronic ones solve that, but require industry to support them. It's actually a net positive but it diversifies the workforce.

We no longer spend most of our time farming, but to say the extra work is unnessecary is too simple minded.

Re: Gaming has more investment, more of a WASTE o

[Immerman]

Everything beyond food, shelter and (arguably) medical care is by its nature unnecessary. *Desirable* maybe, but not necessary - and thus I would group it into some form of entertainment - science (satisfying intellectual curiosity = entertainment), dining out (spending less time cooking, more time focused on company = entertainment),etc. And of course, lots and lots of busywork that produces very little of value other than jobs to keep people fed, and could be eliminated without any loss so long as the Puritan/capitalist idea of jobs determining self- and social-worth (and wealth distribution) went with them.

Technological Darwinism

[Humbubba]

Security tech and it's mirror image, hacking, have been highly prized since 1943, when the codebreakers at Bletchey Park used a set of computers known as "Colossus" to gain unauthorized access to information in an encrypted system. They hacked Germany's best security technology, the Lorenz Sz 40/42 cipher machines, aka "Tunny".

Since then, technology and its security systems have evolved dramatically. But so has hacking. Tools stolen from the NSA are now in the hands of those they were fighting. One has to be pretty adroit to keep up with what's coming down the pike and find the right strategies and techniques to protect their stuff.

I see all this as technological Darwinism, an evolutionary fight for the survival of the fittest information systems, networks and telecommunications, ensuring all those proficient in IT security, which not so ironically includes hackers, a very comfortable living.

Until the system goes down because it wasn't secur

[raymorris]

There is some truth in that. Sometimes there is a trade-off between certain types of security and convenience.

Also, it's VERY inconvenient when the system goes down entirely because it wasn't secured. The easiest attacks are generally denial of service attacks, so if you pay no mind to security you can expect the service to be unavailable frequently. A bit of security would make things a lot more convenient.

It's also pretty darn inconvenient when the system gives wrong results, such as when your bank balance is $10,000 less than it should be, because of a security problem.

Also, as others have pointed out, the definition of security is:
      A secure system continues to operate properly, even when under attack.*

That implies that a secure system operates properly when NOT under attack. A system designed based on security principles doesn't crash, doesn't give wrong results, etc - even when it's under attack, and especially when it's not. A secure system is one that won't screw up *even if you try to make it screw up*, which means it's reliable when you're not trying to make it screw up.

Security has three parts, abbreviated CIA. A secure system provides confidentiality, which is the first thing most laymen think of. The I and A are also important. Integrity means the system provides correct results. Databases designed by application programmers rather than database architects often at this, especially load, when concurrency causes issues. Availability means the system doesn't go down. Earlier today we saw yet again how poorly Slashdot does in this regard, as the site was down AGAIN for several hours.

* That's the Morris definition of security - a secure system is one which continues to operate properly, giving correct results, even when under attack.

Re: Gaming has more investment, more of a WASTE o

[cascadingstylesheet]

Abject poverty, along with the idea that anyone should spend more than half their waking life at work, are purely modern constructs of greed-oriented society.

I was with you until that sentence. Abject poverty and spending more than half your waking life at "work" tasks long, LONG predates modernity.

Re: Gaming has more investment, more of a WASTE o

[Immerman]

I'll admit I use "modern" in a somewhat long-viewed sense. But estimates are that our hunter-gatherer ancestors averaged about 3-4 hours per day on survival-oriented tasks - we were truly the kings of the animal world. Agriculture changed that considerably - but even agriculture involves long months of relatively idle time to counterbalance the crunch of planting and harvest.