4 ms·

That's bad when have tons of connected buggy, unsecured devices powering botnets. Not that I blame hobbyist for that, but such mindset that "hardware is easy" s

by kbart 9y ago

That's bad when have tons of connected buggy, unsecured devices powering botnets. Not that I blame hobbyist for that, but such mindset that "hardware is easy" should not prevail.

watwut 9y ago
The thing is, if you wait till you know things to start learning, you will not learn at all. This is quite visible in programming - people who assume "it is complicated" or try to learn all basics before doing things have low changed of becoming programmers. Whether they came to that conclusion alone or someone gave them that advice, "don't do stuff until you know what you are doing" is bad advice for students. It also filter out precisely the people who tend to listen to advice. Meanwhile, people who confidently do crap despite not knowing anything, make mistakes in the process, but can eventually learn to become good.
- kelnos 9y ago
  Mistakes are fine, and expected as someone is learning, but when you put something out there that has severe security problems, that's... a problem. I don't have a good solution to that. Certainly a lot of the frameworks out there have security bolted on as an afterthought, or, at best, just don't make it easy to build things that are secure by default. But ultimately it comes down to the author of the code to take responsibility for the security of the code they throw out there and promote as something people should use. And that's the crux of it: I want people to experiment and learn, but there needs to be a way to keep those sorts of people from building (or perhaps just distributing or promoting) things that (unintentionally) harm others, at least until they're knowledgeable enough to avoid doing that.
  - watwut 9y ago
    It is surprisingly hard to find good advice on how to code securely beyond absolute basic advice. And a lot of it even bundled in things that are good engineering/process (use linter, code review), but lead to security only indirectly. Code review wont make code more secure if reviewer does not know what to look for when doing said review. The way it works is that general advice I have seen many times is "don't do it". Finding how to code securely or comprehensive list of insecure patterns is much harder. So, people inclined not to follow advice and the ones with huge ego are the ones attempting to create security related software. I am not saying that I have instant solution, but strategy of discouraging people from trying does not work well. Promoting good beginer level write ups would work better. ---------- Nevertheless, the original topic was arduino and doing circuits while being unable to read schematic. That is seen as a problem, because they did not learned theory before doing 5V dummy circuits. And I think it is as good start for learning or getting interest as any.
    - kbart 9y ago
      "Finding how to code securely or comprehensive list of insecure patterns is much harder." The problem is not only secure coding, actually, I'd argue that it's not even the biggest concern. You can produce the most secure code on the whole world, but that won't matter if your device has an unprotected or easily brute forced telnet access by default. Loose default security settings and permissive access is the key concern imho.
    - flukus 9y ago
      If you want to learn how to secure software then learn how to hack. It will give you an insight into the tools and techniques used to breach systems and especially give you an insight on how many attack vectors there are. Kali Linux and the tutorials for that are the Arduino of hacking.
Jedd 9y ago
I'd suggest that upwards of 95% of arduino projects are not accessible via any kind of network connection. Also that around 95% of arduino projects are useful in educating & encouraging people around small microprocessor / electronics projects.
bigB 9y ago
Lol...there are ALOT more buggy , unsecured devices on the internet that are made by companies with "professional" programmers. Look at the crappy DVR's and Webcams coming out of China, not to mention the buggy and perpetually exploitable software that companies like Microsoft and Adobe produce ( and sell for profit) I agree that inexpensive and easy to use developer boards make it easier for a hobbyist to screw up, but the things that are doing the most damage on the net are not hobbyist items.

by kbart 9y ago

That's bad when have tons of connected buggy, unsecured devices powering botnets. Not that I blame hobbyist for that, but such mindset that "hardware is easy" should not prevail.

watwut 9y ago

The thing is, if you wait till you know things to start learning, you will not learn at all. This is quite visible in programming - people who assume "it is complicated" or try to learn all basics before doing things have low changed of becoming programmers. Whether they came to that conclusion alone or someone gave them that advice, "don't do stuff until you know what you are doing" is bad advice for students. It also filter out precisely the people who tend to listen to advice. Meanwhile, people who confidently do crap despite not knowing anything, make mistakes in the process, but can eventually learn to become good.

kelnos 9y ago
Mistakes are fine, and expected as someone is learning, but when you put something out there that has severe security problems, that's... a problem. I don't have a good solution to that. Certainly a lot of the frameworks out there have security bolted on as an afterthought, or, at best, just don't make it easy to build things that are secure by default. But ultimately it comes down to the author of the code to take responsibility for the security of the code they throw out there and promote as something people should use. And that's the crux of it: I want people to experiment and learn, but there needs to be a way to keep those sorts of people from building (or perhaps just distributing or promoting) things that (unintentionally) harm others, at least until they're knowledgeable enough to avoid doing that.
- watwut 9y ago
  It is surprisingly hard to find good advice on how to code securely beyond absolute basic advice. And a lot of it even bundled in things that are good engineering/process (use linter, code review), but lead to security only indirectly. Code review wont make code more secure if reviewer does not know what to look for when doing said review. The way it works is that general advice I have seen many times is "don't do it". Finding how to code securely or comprehensive list of insecure patterns is much harder. So, people inclined not to follow advice and the ones with huge ego are the ones attempting to create security related software. I am not saying that I have instant solution, but strategy of discouraging people from trying does not work well. Promoting good beginer level write ups would work better. ---------- Nevertheless, the original topic was arduino and doing circuits while being unable to read schematic. That is seen as a problem, because they did not learned theory before doing 5V dummy circuits. And I think it is as good start for learning or getting interest as any.
  - kbart 9y ago
    "Finding how to code securely or comprehensive list of insecure patterns is much harder." The problem is not only secure coding, actually, I'd argue that it's not even the biggest concern. You can produce the most secure code on the whole world, but that won't matter if your device has an unprotected or easily brute forced telnet access by default. Loose default security settings and permissive access is the key concern imho.
  - flukus 9y ago
    If you want to learn how to secure software then learn how to hack. It will give you an insight into the tools and techniques used to breach systems and especially give you an insight on how many attack vectors there are. Kali Linux and the tutorials for that are the Arduino of hacking.

Jedd 9y ago

I'd suggest that upwards of 95% of arduino projects are not accessible via any kind of network connection. Also that around 95% of arduino projects are useful in educating & encouraging people around small microprocessor / electronics projects.

bigB 9y ago

Lol...there are ALOT more buggy , unsecured devices on the internet that are made by companies with "professional" programmers. Look at the crappy DVR's and Webcams coming out of China, not to mention the buggy and perpetually exploitable software that companies like Microsoft and Adobe produce ( and sell for profit) I agree that inexpensive and easy to use developer boards make it easier for a hobbyist to screw up, but the things that are doing the most damage on the net are not hobbyist items.