5 ms·

So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Also, I fundamen

So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Also, I fundamentally disagree with your example. If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party, and then fixed it- I'd say, "Good job checking up on yourselves" and move on. Security is still incredibly hard to get right. I'm willing to bet your service has security holes in it, right now- and that's not a hit against you. We haven't mastered these systems and anyone who thinks they have is just waiting to get bit in the ass. Every security professional knows: It's never, ever, a question of "if", but of "when".

zelon88 8y ago
> So what do you say about the idea that it creates a disincentive to find security issues... If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. > If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party They found no evidence of data being accessed, but they also don't share how this particular system tracks data that is accessed. This system was vulnerable for 2-3 years. What if you left your car at my house and you found a dent on it, but I claim that I didn't have any security footage of someone damaging your car without mentioning that I don't actually have security cameras. > I'm willing to bet your service has security holes in it... You're right, and it I find that my NTP service is exploitable and anyone can DDOS me I'll fix it and move on. There's no need to disclose that I'm an idiot when it doesn't affect other people. But when I accidentally leave my servers mis-configured and my API unprotected against unauthorized access I would make a post about it. We're not talking about an arbitrary vulnerability that lets people echo hello on a Google server. They left data exposed. I would like to know if it involves me.
- hn_throwaway_99 8y ago
  > If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. I don't see any evidence to back up this assertion. FWIW I don't believe this is true.
  - deleted 8y ago
    [deleted]
  - ConceptJunkie 8y ago
    Agreed. When is the last time a company failed because of bad security?
- bobdole123456 8y ago
  Equifax seems to be doing alright. Sony hasn’t failed yet. I don’t think your opinion matches with reality.
specialist 8y ago
Imagine you've been driving across the same bridge every day for 3 years, only to discover it had an inevitably catastrophic structural flaw, only revealed when someone bothered to look, but the engineers, contractors, and government didn't want to talk about it. How'd you feel then?
- spdionis 8y ago
  That actually happens. Also bridges are built with a much bigger lifetime in mind and require (proving GP's point) a much bigger investment.
  - specialist 8y ago
    I now think I replied to the wrong post. This thread is more confusing than most. We're all talking past each other. We (this group) likely agrees more than we disagree.
- skj 8y ago
  Depends, did they fix it immediately?
ethbro 8y ago
> We haven't mastered these systems and anyone who thinks they have is just waiting to get bit in the ass. We've absolutely mastered these systems. We just prioritize rapid development time and ease of use over security. People make fun of DoD / space price tags (and admittedly, there's still a lot of crap sold there), but it's a trade off. If we wanted computers to cost $x0,000 and OSes to cost $x,000, and the pace of progress to be glacial, we could have completely secure systems today. It's a choice, not an impossibility.
- ggggtez 8y ago
  >If we wanted computers to cost $x0,000 and OSes to cost $x,000 That's an interesting theory that's not supported by historical evidence as far as I can tell. When computers were expensive, there just were less people with access. The systems were not any more secure.
  - Dou8Le 8y ago
    I think ethbro is saying that focusing on absolutely secure systems would drive up costs, not that if we make them more expensive we'll somehow get more security just because they're more expensive.
    - ggggtez 8y ago
      I think this is overlooking the real criticism, which is that there is no evidence that simply wanting something to be secure would make it so. For example, the parent article, the one this comment is ostensibly in response to, has nothing to do with operating system security.
      - ecnahc515 8y ago
        They weren't suggesting we need more secure OSes specifically, that was just an example. A better example is maybe instead of Google spending $xxx,000 to develop the system that was found insecure they should have spent $x,000,000 so they had more resources devoted to the security aspects. Perhaps this is too high for this system to exist; well maybe that system just shouldn't exist if it can't be secured properly with the budget for it.
fauigerzigerk 8y ago
>So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? But is that really what would happen? Vulnerabilities are frequently found and publicly reported. The reaction depends on the type of vulnerability (how stupid it sounds) and on whether or not the vulnerability resulted in a breach. You don't get hit equally hard for all security issues. I think both users and developers have to be mature enough to deal with this sort of thing without resorting to secrecy. Secrecy creates distrust as the reaction to this particular Google+ issue shows.
falcolas 8y ago
> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Were this actually the case, the CSV list (not even mentioning Google's own Project Zero) would have disincentivized companies and projects years ago.
ecnahc515 8y ago
> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? With big enough repercussions it should incentivize processes that don't allow it to happen in the first place. This is how HIPPA and various other things work already and it does a decent job (not perfect though). I'd also say that we need decide if mistakes are forgivable and whether or not if it's based on impact. Perhaps for a small data leak it's forgivable, and we won't hit them with a huge fine or whatever. If it's a big leak then maybe we need to jail people. It's a bit of a strawman to say everything has security holes because it's assuming the problem is unfixable from the start. It's a bit like launching a person into space. "We know that probability we'll be sending people to their death is high, let's not bother then." We decided to do it anyway but we set extremely high bars for safety.

zelon88 8y ago

> So what do you say about the idea that it creates a disincentive to find security issues... If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. > If they did an adequate investigation, using a 3rd party service, and found no evidence of my data being accessed by a 3rd party They found no evidence of data being accessed, but they also don't share how this particular system tracks data that is accessed. This system was vulnerable for 2-3 years. What if you left your car at my house and you found a dent on it, but I claim that I didn't have any security footage of someone damaging your car without mentioning that I don't actually have security cameras. > I'm willing to bet your service has security holes in it... You're right, and it I find that my NTP service is exploitable and anyone can DDOS me I'll fix it and move on. There's no need to disclose that I'm an idiot when it doesn't affect other people. But when I accidentally leave my servers mis-configured and my API unprotected against unauthorized access I would make a post about it. We're not talking about an arbitrary vulnerability that lets people echo hello on a Google server. They left data exposed. I would like to know if it involves me.

hn_throwaway_99 8y ago
> If a company is disincentivized to look for security holes because it's highly likely it will find them; that company is on the fast-track to failing. I don't see any evidence to back up this assertion. FWIW I don't believe this is true.
- deleted 8y ago
  [deleted]
- ConceptJunkie 8y ago
  Agreed. When is the last time a company failed because of bad security?
bobdole123456 8y ago
Equifax seems to be doing alright. Sony hasn’t failed yet. I don’t think your opinion matches with reality.

specialist 8y ago

Imagine you've been driving across the same bridge every day for 3 years, only to discover it had an inevitably catastrophic structural flaw, only revealed when someone bothered to look, but the engineers, contractors, and government didn't want to talk about it. How'd you feel then?

spdionis 8y ago
That actually happens. Also bridges are built with a much bigger lifetime in mind and require (proving GP's point) a much bigger investment.
- specialist 8y ago
  I now think I replied to the wrong post. This thread is more confusing than most. We're all talking past each other. We (this group) likely agrees more than we disagree.
skj 8y ago
Depends, did they fix it immediately?

ethbro 8y ago

> We haven't mastered these systems and anyone who thinks they have is just waiting to get bit in the ass. We've absolutely mastered these systems. We just prioritize rapid development time and ease of use over security. People make fun of DoD / space price tags (and admittedly, there's still a lot of crap sold there), but it's a trade off. If we wanted computers to cost $x0,000 and OSes to cost $x,000, and the pace of progress to be glacial, we could have completely secure systems today. It's a choice, not an impossibility.

ggggtez 8y ago
>If we wanted computers to cost $x0,000 and OSes to cost $x,000 That's an interesting theory that's not supported by historical evidence as far as I can tell. When computers were expensive, there just were less people with access. The systems were not any more secure.
- Dou8Le 8y ago
  I think ethbro is saying that focusing on absolutely secure systems would drive up costs, not that if we make them more expensive we'll somehow get more security just because they're more expensive.
  - ggggtez 8y ago
    I think this is overlooking the real criticism, which is that there is no evidence that simply wanting something to be secure would make it so. For example, the parent article, the one this comment is ostensibly in response to, has nothing to do with operating system security.
    - ecnahc515 8y ago
      They weren't suggesting we need more secure OSes specifically, that was just an example. A better example is maybe instead of Google spending $xxx,000 to develop the system that was found insecure they should have spent $x,000,000 so they had more resources devoted to the security aspects. Perhaps this is too high for this system to exist; well maybe that system just shouldn't exist if it can't be secured properly with the budget for it.

fauigerzigerk 8y ago

>So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? But is that really what would happen? Vulnerabilities are frequently found and publicly reported. The reaction depends on the type of vulnerability (how stupid it sounds) and on whether or not the vulnerability resulted in a breach. You don't get hit equally hard for all security issues. I think both users and developers have to be mature enough to deal with this sort of thing without resorting to secrecy. Secrecy creates distrust as the reaction to this particular Google+ issue shows.

falcolas 8y ago

> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? Were this actually the case, the CSV list (not even mentioning Google's own Project Zero) would have disincentivized companies and projects years ago.

ecnahc515 8y ago

> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other? With big enough repercussions it should incentivize processes that don't allow it to happen in the first place. This is how HIPPA and various other things work already and it does a decent job (not perfect though). I'd also say that we need decide if mistakes are forgivable and whether or not if it's based on impact. Perhaps for a small data leak it's forgivable, and we won't hit them with a huge fine or whatever. If it's a big leak then maybe we need to jail people. It's a bit of a strawman to say everything has security holes because it's assuming the problem is unfixable from the start. It's a bit like launching a person into space. "We know that probability we'll be sending people to their death is high, let's not bother then." We decided to do it anyway but we set extremely high bars for safety.