5 ms·
What a shamble. This thing with so called security products should be regulated somehow. These sort of exploits should carry a huge fine from the FTC or someth
by danr4 11y ago
What a shamble.
This thing with so called security products should be regulated somehow. These sort of exploits should carry a huge fine from the FTC or something of the sort as this, and many other "security" products (I'm looking at you AVG) is blatant deception, if not the exact opposite.
- VikingCoder 11y agoWe should all demand 3rd-party audits of our security products.
- AznHisoka 11y agoand audits of the 3rd party auditors?
- VikingCoder 11y agoYup. No, really. We'll want to document the successes and failures of security software companies, their auditors, and their auditors.
- andrewd18 11y agoThose responsible for auditing the auditors who have just been audited, have been audited.
- sarciszewski 11y agoWelcome to the "many eyes, shallow bugs" side of the world.
- serge2k 11y agoWhich is why the linux kernel is such a pinnacle of security excellence. /s
- nevi-me 11y agoI presume sarcasm. Interestingly, the auditors would be taking on the risk that they've done a bad job, so their auditors are the security experts who keep finding these security holes.
- sarciszewski 11y agoAs a consultant for a company[1] that provide code auditing services, I welcome third-party scrutiny for the open source libraries[2] we produce. [1] https://paragonie.com https://paragonie.com [2] https://github.com/paragonie https://github.com/paragonie
- electic 11y agoI was really thinking the same thing. Just like electronic products have UL[1] certification, there needs to be a few labs that really look at how these products are architected and the data exposure is like. Then rate them accordingly. [1] http://ul.com/ http://ul.com/
- kuschku 11y agoAnd it’d be even something that politicians could realistically say! > We need the Antivirus-TÜV now!
- Gracana 11y agoImagine if there was some sort of government agency that did this as a service to protect its citizens. Some sort of National Security Agency, if you will... Oh wait, we already have that and they do the opposite. :|
- smt88 11y agoI've been saying for years that unregulated information security will lead to an Enron-level disaster and eventually result in legislation similar to Sarbanes-Oxley. It's a shame it will take a huge disaster for this to happen.
- VikingCoder 11y agoIf we all demanded it now, it theoretically (TM) wouldn't require legislation.
- jarcane 11y agoThe huge disasters have been happening, repeatedly, for years. There are botnets in the millions running on supposedly "Norton-protected" PCs. No one cares. It's not a problem the people in a position to do anything about even understand.
- TheOtherHobbes 11y agoIt's more likely to be Pearl Harbour than Enron if IoT ever becomes popular without improved security. Having your server hacked is one thing. Making kitchen appliances burst into flames - which is not impossible with remote control - is something else entirely. It's a national security issue. Imagine a state actor or a terrorist org deliberately launching a synchronised mass IoT attack against another country. Imagine the attack is untraceable because it's routed through all the botnets out there. It's great the NSA wants backdoors everywhere, because that will make attacks easier to trace - wont't it?
- detaro 11y agoProper penalties on contracts and/or established no-buy lists might be more effective. Push the balance between "boring product" and "useless features" a bit more towards the former.
- sn 11y agoSo who are some legitimate auditors?
- euske 11y agoNot only security products, but all the core parts of our daily software stack. I can imagine, in future, that an OS becomes like a nation. There's a core, transparent "government" component of the system which takes care of all low-level resource managements and security (just like a real life government) and there's a proprietary app which has a secret component but has to play by rule (just like a real private company). All the government behaviors and its legislators (i.e. maintainers) are constantly monitored by its users and media, and they are accountable for their actions. Yes, this is far from perfect, and while we still might have the NSA of a kernel and the Enron of 3rd party apps (whatever it means), I'd argue this is better than the current everything-is-proprietary model.