5 ms·

Utter rubbish. If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. Yes, security is hard, but it is an spectrum, fro

by omeid2 8y ago

Utter rubbish. If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. Yes, security is hard, but it is an spectrum, from compromisable by adolescent thrill-seekers to state-nation actors. Most systems are there to facilitate business, personal, or even more critical, industrial or military operation, none of which you want to be easy to compromise. And as for SaaS, it does nothing to security but increase the attack surface by requiring more components in your system and requiring the system to be always online, in 99% of cases anyways. On top of that, with SaaS you not only have to secure your systems but also safeguard your clients' data, which only reinforces the idea that: if you can't do basic security, you should be out of business. And in what world does DRM helps with security? DRM is nothing short of a device of enforcing draconian copyright laws.

sdhgaiojfsa 8y ago
> If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. So, literally everyone deserves to be out of business? I am not aware of any major software company that has at all times been invulnerable to thrill-seeking adolescents. Perhaps we should coin a new law. The law concerns a statement of the form: "If X, you deserve to be out of business." The law is that the statement is generally false.
- omeid2 8y ago
  > So, literally everyone deserves to be out of business? No. "If X, you deserve Y" is a figure of speech which means Y is a reasonable consequence of X. Just Desert.[0] However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. [0] https://en.wikipedia.org/wiki/Desert_(philosophy) https://en.wikipedia.org/wiki/Desert_(philosophy)
  - plankers 8y ago
    >However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. Tell that to Equifax.
    - jjoonathan 8y ago
      Are you saying they shouldn't go out of business? Because they should -- they just won't, because we have a system that enables them.
      - plankers 8y ago
        No, I agree with you.
dizzystar 8y ago
I have to mostly agree here. There are many things that are full-on egregious. There are other things that are convenient and fairly vulnerable. I don't think these things are discussed enough, but they ought to be. Many things in SaaS or PaaS are convenient, but you sacrifice a class of security. I'm not sure if the script is changed across the board enough to compensate.
dleslie 8y ago
Game security is not simply securing channels from eavesdropping or validating identity; it's about realtime distributed systems with eventual consistency and untrustworthy agents. At some level, it is a matter of either validating all behaviour suggested by remote clients, not accepting anything more than controller inputs from remote clients, or throwing caution to the wind and letting them have at it. Each have their benefits and caveats. And once you're hosting dedicated servers, why not go one farther and treat it as the SaaS it is?
heavenlyblue 8y ago
This is not how most of the law works, though. If you are a weak person, does that justify the actions of a few armed robbers that are going to mug you on the street? Do you mean I had to take care of my own security by hiring someone all the time? Then why am I paying my taxes to support the police force? Most of the businesses in the real world operate on a combination of trust and optimism. The moment you take away that stability, businesses suddenly become way less efficient. Let’s be honest: security in IT is just like security in the physical world. Stealing a car that had an open door is as illegal as stealing a car by picking it’s lock. In such a scenario hacking is just another dimension to physical warfare - and frankly warfare belongs to the military. The fact that most of the bigger companies had to deal with security themselves is just another matter: they had to operate in the world where the authorities were yet not good enough at tracking hackers. Today though - I can see where businesses that don’t think their security matters would just not bother. It’s not their area of responsibility and I would rather they did what they do well - make money.
- omeid2 8y ago
  The objective of law is not to emulate but rather constrain and govern society. It is not hard to argue that the subject matter of each and every law and code is based on immediate or at least likely, if not precedent, events rather than to naively assume that, that which is illegal should not happen and leave your car unlocked. Besides, my argument and criticism is not concerned with sanctioning of unfavorable behavior but rather holding accountable those who make promises and sales you products. > It’s not their area of responsibility and I would rather they did what they do well - make money. But why not? the car maker is not in the business of providing security guards, but I bet you wouldn't be happy if they made cars that were easy to pick, why would this not apply to other business? Most online business make a big deal of security in their sales, why not holding accountable for those promises?
- wolfgke 8y ago
  > Let’s be honest: security in IT is just like security in the physical world. No, it is completely different: In the internet - the culprit can be anywhere in the world - the computer/network, where the attack comes from is usually just a node in a botnet - So you do not have to just deal with the judicial system of your own country, but with any possible judicial system in the world. - You can hardly ever find out, where the real origin of the attack is - so you cannot even know which judicial system you have to call to.
lawnchair_larry 8y ago
Haha, spoken like someone who knows nothing about security in real world companies. In your world, there are no companies that use computers left.

by omeid2 8y ago

sdhgaiojfsa 8y ago

> If thrill-seeking adolescents can compromise your systems, you deserve to be out of business. So, literally everyone deserves to be out of business? I am not aware of any major software company that has at all times been invulnerable to thrill-seeking adolescents. Perhaps we should coin a new law. The law concerns a statement of the form: "If X, you deserve to be out of business." The law is that the statement is generally false.

omeid2 8y ago
> So, literally everyone deserves to be out of business? No. "If X, you deserve Y" is a figure of speech which means Y is a reasonable consequence of X. Just Desert.[0] However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. [0] https://en.wikipedia.org/wiki/Desert_(philosophy) https://en.wikipedia.org/wiki/Desert_(philosophy)
- plankers 8y ago
  >However, "if you can't do _basic security_, you should be out of business", I mean that one in the literal sense of it. Tell that to Equifax.
  - jjoonathan 8y ago
    Are you saying they shouldn't go out of business? Because they should -- they just won't, because we have a system that enables them.
    - plankers 8y ago
      No, I agree with you.

dizzystar 8y ago

I have to mostly agree here. There are many things that are full-on egregious. There are other things that are convenient and fairly vulnerable. I don't think these things are discussed enough, but they ought to be. Many things in SaaS or PaaS are convenient, but you sacrifice a class of security. I'm not sure if the script is changed across the board enough to compensate.

dleslie 8y ago

Game security is not simply securing channels from eavesdropping or validating identity; it's about realtime distributed systems with eventual consistency and untrustworthy agents. At some level, it is a matter of either validating all behaviour suggested by remote clients, not accepting anything more than controller inputs from remote clients, or throwing caution to the wind and letting them have at it. Each have their benefits and caveats. And once you're hosting dedicated servers, why not go one farther and treat it as the SaaS it is?

heavenlyblue 8y ago

This is not how most of the law works, though. If you are a weak person, does that justify the actions of a few armed robbers that are going to mug you on the street? Do you mean I had to take care of my own security by hiring someone all the time? Then why am I paying my taxes to support the police force? Most of the businesses in the real world operate on a combination of trust and optimism. The moment you take away that stability, businesses suddenly become way less efficient. Let’s be honest: security in IT is just like security in the physical world. Stealing a car that had an open door is as illegal as stealing a car by picking it’s lock. In such a scenario hacking is just another dimension to physical warfare - and frankly warfare belongs to the military. The fact that most of the bigger companies had to deal with security themselves is just another matter: they had to operate in the world where the authorities were yet not good enough at tracking hackers. Today though - I can see where businesses that don’t think their security matters would just not bother. It’s not their area of responsibility and I would rather they did what they do well - make money.

omeid2 8y ago
The objective of law is not to emulate but rather constrain and govern society. It is not hard to argue that the subject matter of each and every law and code is based on immediate or at least likely, if not precedent, events rather than to naively assume that, that which is illegal should not happen and leave your car unlocked. Besides, my argument and criticism is not concerned with sanctioning of unfavorable behavior but rather holding accountable those who make promises and sales you products. > It’s not their area of responsibility and I would rather they did what they do well - make money. But why not? the car maker is not in the business of providing security guards, but I bet you wouldn't be happy if they made cars that were easy to pick, why would this not apply to other business? Most online business make a big deal of security in their sales, why not holding accountable for those promises?
wolfgke 8y ago
> Let’s be honest: security in IT is just like security in the physical world. No, it is completely different: In the internet - the culprit can be anywhere in the world - the computer/network, where the attack comes from is usually just a node in a botnet - So you do not have to just deal with the judicial system of your own country, but with any possible judicial system in the world. - You can hardly ever find out, where the real origin of the attack is - so you cannot even know which judicial system you have to call to.

lawnchair_larry 8y ago

Haha, spoken like someone who knows nothing about security in real world companies. In your world, there are no companies that use computers left.