4 ms·

The description of the legacy == successful application sounds like that J2EE app that every company has that isn't being patched and just may end up getting yo

The description of the legacy == successful application sounds like that J2EE app that every company has that isn't being patched and just may end up getting you on the front page of the WSJ once it gets breached.

AnIdiotOnTheNet 9y ago
Security in the real world is about risk analysis. In broad form, if the risk of the breach and pad publicity times the cost said breach is less than the cost of redesigning a working tool (or implementing any other fix), then you don't do it.
- youdontknowtho 9y ago
  I'm aware of how capitalism works, but I'm not sure that equation is as straightforward as you stated. That value of risk is going up. Since the article was about architecture, I was trying to point out that existing architectures have real issues.
  - AnIdiotOnTheNet 9y ago
    And I'm trying to point out that those issues are largely irrelevant in the context of how the world actually works. You can never completely eliminate risk, only reduce it, and that reduction has costs associated with it (whether you choose to consider costs only as internal to an organization or in a broader context doesn't matter), and many times, the cost of reducing the risk outweighs any gains. It annoys me that people see "security" as a thing worth doing for its own sake. It isn't. Like almost everything else in life, it is a matter of balance. Besides, the cost of risk isn't going up. Big breaches lately off the top of my head: Sony PSN (several times), Equifax, Target, and several hospitals and schools. To my knowledge, nearly all organizations breached are still in business and often not significantly less profitable than they were before. By the internal cost metric of the organization, then, the cost was minimal. But even considering the larger ramifications on a societal scale, what has really been affected? There's been a lot of talk, and I'm sure there's been some identity theft, but the economy remains largely unaffected and so do our daily lives.
    - hackerfromthefu 9y ago
      The cost of those breaches is often externalised - https://www.investopedia.com/terms/e/externality.asp https://www.investopedia.com/terms/e/externality.asp https://www.bjs.gov/index.cfm?ty=tp&tid=42 https://www.bjs.gov/index.cfm?ty=tp&tid=42 indicates that 17.6 million americans were affected by identity theft in 2014 .. sounds significant. The other thing to consider is the impact it can have on someones life, even if 99.5% of Americans aren't affected in any given year and only 17 million were, the impact of it can be huge on an individuals life. ps just used America as that was the first stats I found. First world is going to be a more prevalent target as they have more money to steal ..
      - AnIdiotOnTheNet 9y ago
        Pretty much any policy decision will have a huge impact on some individual's life, but that has nothing to do with whether or not we should enact policy does it? If I want to end the mortgage tax deduction, that's going to negatively affect every homeowner (including me, I might add), but that doesn't mean we shouldn't do it.
    - hackerfromthefu 9y ago
      But I agree the cost is often not significant to companies, yet. Legislation and company costs are going to ramp up though, the pooch is getting screwed too often, and publicly .. Equifax CEO, CIO, CSO all gone, and may be done for insider trading .. http://money.cnn.com/2017/09/19/technology/equifax-legal-issues/index.html http://money.cnn.com/2017/09/19/technology/equifax-legal-iss... http://thehill.com/policy/technology/350634-ftc-launches-investigation-into-equifax-breach http://thehill.com/policy/technology/350634-ftc-launches-inv... http://www.zerohedge.com/news/2017-09-15/another-equifax-coverup-did-company-scrub-its-chief-security-officer-was-music-major http://www.zerohedge.com/news/2017-09-15/another-equifax-cov...
      - AnIdiotOnTheNet 9y ago
        The insider trading is orthogonal to the issue of security policy though. Companies shed C levels all the time for a wide variety of reasons, it isn't that big a cost on the whole.
hackerfromthefu 9y ago
How many people are updating the hundreds of packages their NPM apps depend on? General advice is to pin them so they don't break your app daily, which is another way of saying don't update them.. Those packages are also of hugely varying quality, in a language that leaks abstractions for breakfast, and with minimal integration testing between all the versions of all the packages .. Platform frameworks such as J2EE and .NET are much safer by my analysis, although .NET has recently moved to a similar package potpourri.

AnIdiotOnTheNet 9y ago

Security in the real world is about risk analysis. In broad form, if the risk of the breach and pad publicity times the cost said breach is less than the cost of redesigning a working tool (or implementing any other fix), then you don't do it.

youdontknowtho 9y ago
I'm aware of how capitalism works, but I'm not sure that equation is as straightforward as you stated. That value of risk is going up. Since the article was about architecture, I was trying to point out that existing architectures have real issues.
- AnIdiotOnTheNet 9y ago
  And I'm trying to point out that those issues are largely irrelevant in the context of how the world actually works. You can never completely eliminate risk, only reduce it, and that reduction has costs associated with it (whether you choose to consider costs only as internal to an organization or in a broader context doesn't matter), and many times, the cost of reducing the risk outweighs any gains. It annoys me that people see "security" as a thing worth doing for its own sake. It isn't. Like almost everything else in life, it is a matter of balance. Besides, the cost of risk isn't going up. Big breaches lately off the top of my head: Sony PSN (several times), Equifax, Target, and several hospitals and schools. To my knowledge, nearly all organizations breached are still in business and often not significantly less profitable than they were before. By the internal cost metric of the organization, then, the cost was minimal. But even considering the larger ramifications on a societal scale, what has really been affected? There's been a lot of talk, and I'm sure there's been some identity theft, but the economy remains largely unaffected and so do our daily lives.
  - hackerfromthefu 9y ago
    The cost of those breaches is often externalised - https://www.investopedia.com/terms/e/externality.asp https://www.investopedia.com/terms/e/externality.asp https://www.bjs.gov/index.cfm?ty=tp&tid=42 https://www.bjs.gov/index.cfm?ty=tp&tid=42 indicates that 17.6 million americans were affected by identity theft in 2014 .. sounds significant. The other thing to consider is the impact it can have on someones life, even if 99.5% of Americans aren't affected in any given year and only 17 million were, the impact of it can be huge on an individuals life. ps just used America as that was the first stats I found. First world is going to be a more prevalent target as they have more money to steal ..
    - AnIdiotOnTheNet 9y ago
      Pretty much any policy decision will have a huge impact on some individual's life, but that has nothing to do with whether or not we should enact policy does it? If I want to end the mortgage tax deduction, that's going to negatively affect every homeowner (including me, I might add), but that doesn't mean we shouldn't do it.
  - hackerfromthefu 9y ago
    But I agree the cost is often not significant to companies, yet. Legislation and company costs are going to ramp up though, the pooch is getting screwed too often, and publicly .. Equifax CEO, CIO, CSO all gone, and may be done for insider trading .. http://money.cnn.com/2017/09/19/technology/equifax-legal-issues/index.html http://money.cnn.com/2017/09/19/technology/equifax-legal-iss... http://thehill.com/policy/technology/350634-ftc-launches-investigation-into-equifax-breach http://thehill.com/policy/technology/350634-ftc-launches-inv... http://www.zerohedge.com/news/2017-09-15/another-equifax-coverup-did-company-scrub-its-chief-security-officer-was-music-major http://www.zerohedge.com/news/2017-09-15/another-equifax-cov...
    - AnIdiotOnTheNet 9y ago
      The insider trading is orthogonal to the issue of security policy though. Companies shed C levels all the time for a wide variety of reasons, it isn't that big a cost on the whole.

hackerfromthefu 9y ago

How many people are updating the hundreds of packages their NPM apps depend on? General advice is to pin them so they don't break your app daily, which is another way of saying don't update them.. Those packages are also of hugely varying quality, in a language that leaks abstractions for breakfast, and with minimal integration testing between all the versions of all the packages .. Platform frameworks such as J2EE and .NET are much safer by my analysis, although .NET has recently moved to a similar package potpourri.