4 ms·

I have a mental tool that I rely on to help avoiding indulgence in silly thoughts. I want to share it, but it sounds kind of harsh, so I want to make sure that

I have a mental tool that I rely on to help avoiding indulgence in silly thoughts. I want to share it, but it sounds kind of harsh, so I want to make sure that I am forcefully communicating the spirit of it's intention. It's a tool that helps me- not a judgement of your comment. "If" is for children. The scenario you are describing is a hypothetical which is not based on the state of software development today. We are not likely to be dealing with the ability to build an unbreakable phone any time soon. We are certainly dealing with the condition of failure- companies can't seem to keep data secret, even when they want to. Your question is built on a flawed premise. Show me a way to reliably constrain a developer so that when they compile, the data you want to keep secret reliably stays secret, and then I'll be happy to indulge in this scenario. For now, we are just too shitty at developing bug free, let alone secure software.

cortesoft 11y ago
That is a silly notion... 'if' is not for children, 'if' is for conditional statements. As software developers, we use 'if' every single day of our lives. Stating things in the form of conditionals is very important when talking about the future (since the future is full of conditionals). Also, as far as 'showing you a way' that 'the data you want to keep secret reliably stays secret'... well, that is the definition of encryption, and we are pretty good at encryption. In fact, if we weren't, then this entire case would be a moot point.
- droopybuns 11y ago
  If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense: https://twitter.com/matthew_d_green/status/709919895002042368 https://twitter.com/matthew_d_green/status/70991989500204236... "We can barely encrypt." This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf http://www.crypto.com/papers/p25sec.pdf >>Also, as far as 'showing you a way' ... My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects. So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto). Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially real.

cortesoft 11y ago

That is a silly notion... 'if' is not for children, 'if' is for conditional statements. As software developers, we use 'if' every single day of our lives. Stating things in the form of conditionals is very important when talking about the future (since the future is full of conditionals). Also, as far as 'showing you a way' that 'the data you want to keep secret reliably stays secret'... well, that is the definition of encryption, and we are pretty good at encryption. In fact, if we weren't, then this entire case would be a moot point.

droopybuns 11y ago
If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense: https://twitter.com/matthew_d_green/status/709919895002042368 https://twitter.com/matthew_d_green/status/70991989500204236... "We can barely encrypt." This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf http://www.crypto.com/papers/p25sec.pdf >>Also, as far as 'showing you a way' ... My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects. So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto). Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially real.