4 ms·

> Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long

> Why is the overwhelming majority of networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems enough to fix software that must speak certain protocols? This is a super naive view of the world. Nowadays most hacking incidents are based on social engineering, meaning it's not the technology that's weak, it's humans who are the least secure. Yes that includes you and me. So NO, your solution won't fix anything. Believing that a technical solution can fix everything is the most dangerous thing because in reality it will never be safe but you just have a false sense of safety, which is how most hacks happen--most hacks are carried out by taking advantage of this mentality that everything is safe enough, which in reality isn't. You will probably believe that the system you designed is super safe because it only lets people do what they said they wanted to do, but as I said, most hacking incidents are social engineering, so someone will definitely take advantage of this and attack you where you least expect it.

hellbanner 9y ago
Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems. The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically). Heartbleed was an issue of exactly this "The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software" Architecturally, this should never have been possible. http://www.pl-enthusiast.net/2014/07/01/how-did-heartbleed-remain-undiscovered-and-what-should-we-do-about-it/ http://www.pl-enthusiast.net/2014/07/01/how-did-heartbleed-r... http://heartbleed.com/ http://heartbleed.com/ Obviously attackers are going to look for the weakest point, but your agument sounds like "social engineering should happen, so don't bother locking your doors at all".
- cocktailpeanuts 9y ago
  No i was only arguing it's not as easy as you think. Just like your solution you suggested can easily be hacked, any technological solution a human being comes up with is vulnerable to hacks. The only thing I was criticizing was you seem to think it's easy to simply create a secure system. It's not. That's why there are tons of smart people in security but hacks still happen.
  - pharrington 9y ago
    He's saying we know how to increase the energy needed to compromise a system, while spending less energy than would otherwise happen in the case of compromise. The harder a task is, the less often the task occurs.
  - hellbanner 9y ago
    Yes hacks still happen. See pharrington's response. I don't think it's easy to create a secure system. I'm in favor of making software more difficult to hack. I think the Heartbleed example speaks for itself.

hellbanner 9y ago

Social engineering is responsible for in part or entirety many hacks. I'm not arguing that technical solutions will "fix everything". Technical stability is on aspect of secure systems. The video is arguing: why should a doorbell have the ability to set your house on fire? (Metaphorically). Heartbleed was an issue of exactly this "The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software" Architecturally, this should never have been possible. http://www.pl-enthusiast.net/2014/07/01/how-did-heartbleed-remain-undiscovered-and-what-should-we-do-about-it/ http://www.pl-enthusiast.net/2014/07/01/how-did-heartbleed-r... http://heartbleed.com/ http://heartbleed.com/ Obviously attackers are going to look for the weakest point, but your agument sounds like "social engineering should happen, so don't bother locking your doors at all".

cocktailpeanuts 9y ago
No i was only arguing it's not as easy as you think. Just like your solution you suggested can easily be hacked, any technological solution a human being comes up with is vulnerable to hacks. The only thing I was criticizing was you seem to think it's easy to simply create a secure system. It's not. That's why there are tons of smart people in security but hacks still happen.
- pharrington 9y ago
  He's saying we know how to increase the energy needed to compromise a system, while spending less energy than would otherwise happen in the case of compromise. The harder a task is, the less often the task occurs.
- hellbanner 9y ago
  Yes hacks still happen. See pharrington's response. I don't think it's easy to create a secure system. I'm in favor of making software more difficult to hack. I think the Heartbleed example speaks for itself.