4 ms·
The idea that Microsoft or Google would create "opposition labs" to attack each other is pretty far out there. You may have been in the jungle of security just
by staunch 16y ago
The idea that Microsoft or Google would create "opposition labs" to attack each other is pretty far out there. You may have been in the jungle of security just a wee bit too long.
- tptacek 16y agoI think you're just reacting to the name I chose. Obviously, plenty of companies large and small run labs staffed with people who do nothing but find flaws in other companies code. For, uh, all sorts of reasons.
- staunch 16y agoYou're insinuating there are groups inside major companies setup with the express purpose of discovering and releasing exploits against competitive products? Since plenty of companies do this, I'm sure it would be easy for you to show evidence of a few examples.
- tptacek 16y agoIt would in fact be easy to do that, but I'm not going to. You are free to believe I am making things up about vulnerability research, which I've been doing professionally since 1995. (Note that I didn't assert it; I insinuated it.)
- RiderOfGiraffes 16y agoSince the comment to which you're replying uses the word "insinuating" I deduce that originally it said "asserting" but after your comment it was edited by staunch without a note to say so. Yes?
- staunch 16y agoHe's just crazy! Nah, I did change it, and I should have noted it, my bad.
- jerf 16y agoMan, that would be awesome. Companies aren't doing a very good job of policing themselves, if they policed each other customers would win big time.
- Groxx 16y agoI dunno, sounds like an ideal anti-competitive tool to kill off potential competitors before they get too big. It'd also encourage behavior similar to patent trolls, let them get big enough to royally screw for big monies.
- khafra 16y agoIf we proceed on the assumption that the blackhats will find holes the white hats don't find first, it'd still be a good thing. At the limit of this behavior, the only software producer left would be Daniel J. Bernstein, which would be sort of awkward, but if you want things built secure you want them built secure.
- jerf 16y agoI think that while the transition would be rocky, there would be a lot more work done on languages, libraries, and frameworks that are secure by default, rather than insecure by default, and in the end people would end up a lot better trained. We get insecure software for a variety of reasons, including lack of incentives to produce secure software (or equivalently lack of penalties for failing), ignorance, lack of sufficient talent or intelligence to deal with the issues of security, and so on. At least taking care of the first one would have some sort of effect. It would probably also drum some people out of software development, at least professionally, but one could fruitfully argue that anyone intellectual incapable of writing secure software would probably be better employed elsewhere anyhow.