5 ms·

Is IE entirely to blame, really? What about an operating system that allows a web browser sufficient prominence within the system even to allow a susceptibility

by cgs1019 17y ago

Is IE entirely to blame, really? What about an operating system that allows a web browser sufficient prominence within the system even to allow a susceptibility that enables hackers to “perform reconnaissance and gain complete control over the compromised system.” I understand that a government would be hard-pressed to suggest that a nation forgo using an OS that is so deeply embedded in many organizations' and people's day-to-day operation, but even a brief acknowledgement of what is the underlying problem (worldwide deployment of an out-of-date operating system inextricably and systemically intertwined with the function of an abhorrently insecure electronic portal to the entire world of internet-enabled machines [I'm referring here to Internet Explorer]) would really help the much-needed movement to spread awareness of the more secure, cheaper alternatives (I'm referring here to Linux-based systems). In any case, it's always great to see organizations with clout holding Microsoft publicly accountable for its indiscretions.

tptacek 17y ago
I have to ask what this even means. The last time the world started holding Microsoft publicly accountable for its security indiscretions was the "Summer of Worms" in '03. From that point on, starting with WinXP SP 2, Microsoft has put an absolutely huge amount of effort into security, including: * Training virtually all of their developers on secure coding * Modifying their core libraries to avoid dangerous idioms * Spending tens of thousands of dollars per product per release on external security testing * Slowing down dev cycles with "SDL" measures like threat modeling and code review * Holding off releases to audit for new bug classes I'm not saying that Microsoft ships perfect software, because what I'm saying is that it's impossible to ship perfect software.
- jrockway 17y ago
  I'm not saying that Microsoft ships perfect software, because what I'm saying is that it's impossible to ship perfect software. When you write it in C/C++, anyway. (I think Microsoft has almost solved this problem, though, with their heavy investment in the CLR and languages like F# on top of the CLR. Even C# is fine, compared to C or C++. You can still write insecure software in managed languages, but it will be because of a careless design, not forgetting to tack a "\0" on the end of a block of memory.)
  - tptacek 17y ago
    Python, Ruby, and Java web applications are riddled with domain-specific vulnerabilities. I'm sorry, there simply aren't any easy answers here.
    - jrockway 17y ago
      I think the problem is "web applications" and not Python, Ruby, or Java. Mostly. (If you were writing your web applications in C, you'd have to worry about memory corruption problems AND cross-site request forgeries.)
- rbanffy 17y ago
  "it's impossible to ship perfect software." That is simply not true. It may be very difficult, it may be insanely expensive and it may require an immense effort to thoroughly inspect the whole stack that is under the software (down to the hardware level, that is, with some attention on how external events may influence the hardware) but no. It's not impossible to ship perfect software, specially if you restrict the definition of "perfect" as doing what it's supposed to do, no more and no less.
  - tptacek 17y ago
    Dan Bernstein couldn't do it. But sure, let's argue about this point. A lot.
    - nostrademons 17y ago
      I suspect rbanffy is talking about things like avionics, medical device control, and the space shuttle. This is a whole other ball game, and it is possible to ship software that is pretty darn close to perfect in those domains. They cost a few orders of magnitude more per requirement, and the requirements are sharply limited. These systems usually operate on a very limited number of input values and internal states, so you can often simply enumerate all the possible inputs and all the possible states to verify that the system works as designed.
      - rbanffy 17y ago
        I wasn't thinking about these markets, but their mere existence proves perfect software can be written - it's possible. What I was thinking was the bold statement that doing something right (or perfectly right) is impossible and its widespread use as an excuse for not even trying. A software developer must aim for perfect software, even if shipping it is not always economically viable. The fact end-users have been beaten into submission and now tolerate having to restart their computers after software crashes or to redo calculations because the results were absurd the first time is not relevant to this discussion. If they tolerate less than correctness, we shouldn't. The current security problems we have are entirely fault of people who regard immediate profit as more important than long-term quality. And I take exception with anyone who suggests this is how things should be.

by cgs1019 17y ago

tptacek 17y ago

I have to ask what this even means. The last time the world started holding Microsoft publicly accountable for its security indiscretions was the "Summer of Worms" in '03. From that point on, starting with WinXP SP 2, Microsoft has put an absolutely huge amount of effort into security, including: * Training virtually all of their developers on secure coding * Modifying their core libraries to avoid dangerous idioms * Spending tens of thousands of dollars per product per release on external security testing * Slowing down dev cycles with "SDL" measures like threat modeling and code review * Holding off releases to audit for new bug classes I'm not saying that Microsoft ships perfect software, because what I'm saying is that it's impossible to ship perfect software.

jrockway 17y ago
I'm not saying that Microsoft ships perfect software, because what I'm saying is that it's impossible to ship perfect software. When you write it in C/C++, anyway. (I think Microsoft has almost solved this problem, though, with their heavy investment in the CLR and languages like F# on top of the CLR. Even C# is fine, compared to C or C++. You can still write insecure software in managed languages, but it will be because of a careless design, not forgetting to tack a "\0" on the end of a block of memory.)
- tptacek 17y ago
  Python, Ruby, and Java web applications are riddled with domain-specific vulnerabilities. I'm sorry, there simply aren't any easy answers here.
  - jrockway 17y ago
    I think the problem is "web applications" and not Python, Ruby, or Java. Mostly. (If you were writing your web applications in C, you'd have to worry about memory corruption problems AND cross-site request forgeries.)
rbanffy 17y ago
"it's impossible to ship perfect software." That is simply not true. It may be very difficult, it may be insanely expensive and it may require an immense effort to thoroughly inspect the whole stack that is under the software (down to the hardware level, that is, with some attention on how external events may influence the hardware) but no. It's not impossible to ship perfect software, specially if you restrict the definition of "perfect" as doing what it's supposed to do, no more and no less.
- tptacek 17y ago
  Dan Bernstein couldn't do it. But sure, let's argue about this point. A lot.
  - nostrademons 17y ago
    I suspect rbanffy is talking about things like avionics, medical device control, and the space shuttle. This is a whole other ball game, and it is possible to ship software that is pretty darn close to perfect in those domains. They cost a few orders of magnitude more per requirement, and the requirements are sharply limited. These systems usually operate on a very limited number of input values and internal states, so you can often simply enumerate all the possible inputs and all the possible states to verify that the system works as designed.
    - rbanffy 17y ago
      I wasn't thinking about these markets, but their mere existence proves perfect software can be written - it's possible. What I was thinking was the bold statement that doing something right (or perfectly right) is impossible and its widespread use as an excuse for not even trying. A software developer must aim for perfect software, even if shipping it is not always economically viable. The fact end-users have been beaten into submission and now tolerate having to restart their computers after software crashes or to redo calculations because the results were absurd the first time is not relevant to this discussion. If they tolerate less than correctness, we shouldn't. The current security problems we have are entirely fault of people who regard immediate profit as more important than long-term quality. And I take exception with anyone who suggests this is how things should be.