3 ms·

The US seems like it has a very undeveloped policy on digital defense. It seems like with this issue and the large breaches in security in the past, and the FBI

by dv_dt 10y ago

The US seems like it has a very undeveloped policy on digital defense. It seems like with this issue and the large breaches in security in the past, and the FBI pushing for even more weakening of encryption that the US government lacks a strong internal advocate to promote the development and installation defensive infrastructure for both in gov't and the US tech infrastructure.

tptacek 10y ago
Every country in the world has underdeveloped digital defense. There is no secure country anywhere. It has nothing whatsoever to do with encryption policy (one of the rare tech policy issues that I agree wholeheartedly with the HN conventional wisdom on). It's that software security is simply an unsolved problem, but the world is plowing full speed ahead into deploying more and more of it, and will continue to do so.
- willtim 10y ago
  I think it is more correct to say that software security is not a priority. Another issue is why the US connect highly sensitive systems into the internet in the first place.
- dv_dt 10y ago
  I guess I'm thinking less about the state of the technology deployment (which will always be in some sort of play), and more about the political/bureaucratic organizations within the government and their focus. It feels, from a very, very outside position, that the gov't (NSA, et al) used to put more resources on systematically figuring out how to move defensive side work forward. Maybe the orgs that used to be tasked with that were reorged or demphasized, I don't really know.
nickpsecurity 10y ago
The US had one... even invented INFOSEC developing it... that mandated a combo of features, assurance, and pentesting by NSA hackers. Under Computer Security Initiative, DOD combined clear standards for how to do it with financial incentives for market to produce it. The result were quite a few systems produced that survived 2-5 years of pentesting with none at least admitting a hack in the field around 20 years. Standards evolved into EAL6/7 of Common Criteria but red tape and handwaiving dominates. That's because Congress changed acquisition policy to force them to buy more COTS garbage to benefit campaign contributors plus NSA started competing with market under MISSI. High-assurance mostly collapsed. So, it can be done but politicians are preventing it. Market is bigger problem, though. Burroughs B5000 was first, high-security system nearly immune to code injection in 1961. They did good in market but IBM had better price/performance. That plus more feature improvements is all market will really buy. Something uglier, slower, a few less features, and cost double for the security? Most wont go for that. They usually dont do it even if the software is free and easy to use like a few in FOSS with strong security. So, suppliers are right to keep giving them the garbage they demand until they'll pay for something better. Note: Companies and CompSci people continue developing higher, security stuff anyway. Just very few of them with commercial stuff costing big $$$ due to low volume/demand and academic stuff delivered in prototype form since FOSS people dont put time in them. Hard to see how it will get better on a large scale.

by dv_dt 10y ago

tptacek 10y ago

Every country in the world has underdeveloped digital defense. There is no secure country anywhere. It has nothing whatsoever to do with encryption policy (one of the rare tech policy issues that I agree wholeheartedly with the HN conventional wisdom on). It's that software security is simply an unsolved problem, but the world is plowing full speed ahead into deploying more and more of it, and will continue to do so.

willtim 10y ago
I think it is more correct to say that software security is not a priority. Another issue is why the US connect highly sensitive systems into the internet in the first place.
dv_dt 10y ago
I guess I'm thinking less about the state of the technology deployment (which will always be in some sort of play), and more about the political/bureaucratic organizations within the government and their focus. It feels, from a very, very outside position, that the gov't (NSA, et al) used to put more resources on systematically figuring out how to move defensive side work forward. Maybe the orgs that used to be tasked with that were reorged or demphasized, I don't really know.

nickpsecurity 10y ago

The US had one... even invented INFOSEC developing it... that mandated a combo of features, assurance, and pentesting by NSA hackers. Under Computer Security Initiative, DOD combined clear standards for how to do it with financial incentives for market to produce it. The result were quite a few systems produced that survived 2-5 years of pentesting with none at least admitting a hack in the field around 20 years. Standards evolved into EAL6/7 of Common Criteria but red tape and handwaiving dominates. That's because Congress changed acquisition policy to force them to buy more COTS garbage to benefit campaign contributors plus NSA started competing with market under MISSI. High-assurance mostly collapsed. So, it can be done but politicians are preventing it. Market is bigger problem, though. Burroughs B5000 was first, high-security system nearly immune to code injection in 1961. They did good in market but IBM had better price/performance. That plus more feature improvements is all market will really buy. Something uglier, slower, a few less features, and cost double for the security? Most wont go for that. They usually dont do it even if the software is free and easy to use like a few in FOSS with strong security. So, suppliers are right to keep giving them the garbage they demand until they'll pay for something better. Note: Companies and CompSci people continue developing higher, security stuff anyway. Just very few of them with commercial stuff costing big $$$ due to low volume/demand and academic stuff delivered in prototype form since FOSS people dont put time in them. Hard to see how it will get better on a large scale.