3 ms·

Inverse logic is valid too. Any sufficiently popular "thing to crack" is doomed in the long run. ... They are just training offences.

SmellyGeekBoy 8y ago
Any kind of computer security has always been an ongoing cat-and-mouse game and probably always will be.
xoa 8y ago
>Inverse logic is valid too. Actually it's not. >Any sufficiently popular "thing to crack" is doomed in the long run. ... They are just training offences. No, because these are not symmetric operations. There is nothing mathematically impossible about bug free software. While the Halting Problem means that we can't just formally take any arbitrary program and solve all its states, it is possible to formally prove small programs and additively build up, and to approach a limit of zero with enough brute force over time particularly in simple programs. If they are not changing and actively gaining new informal features then they will not be automatically gaining new vulnerabilities either, and for all these very reasons it's standard practice to try to separate security core code and make it as simple and static as possible beyond bug fixes. So unlike the real world in software defense is actually in a naturally stronger position if managed well. Software history is a spiral not a circle, security practices are improving and legacy is being reduced over time. A lot of easy mistakes of the past don't happen so much or at all anymore, and Apple has definitely benefitted long term from the hunt for exploits in hardening their ecosystem. Bugs still exist, but they're not low hanging fruit anymore, they're harder to find and more restricted in scope and more must be chained together for wider access.
- dev_dull 8y ago
  > No, because these are not symmetric operations. There is nothing mathematically impossible about bug free software. To me this is like saying there’s nothing mathematically impossible about a perfect vacuum. There’s always something leaking energy/attack surface.

SmellyGeekBoy 8y ago

Any kind of computer security has always been an ongoing cat-and-mouse game and probably always will be.

xoa 8y ago

>Inverse logic is valid too. Actually it's not. >Any sufficiently popular "thing to crack" is doomed in the long run. ... They are just training offences. No, because these are not symmetric operations. There is nothing mathematically impossible about bug free software. While the Halting Problem means that we can't just formally take any arbitrary program and solve all its states, it is possible to formally prove small programs and additively build up, and to approach a limit of zero with enough brute force over time particularly in simple programs. If they are not changing and actively gaining new informal features then they will not be automatically gaining new vulnerabilities either, and for all these very reasons it's standard practice to try to separate security core code and make it as simple and static as possible beyond bug fixes. So unlike the real world in software defense is actually in a naturally stronger position if managed well. Software history is a spiral not a circle, security practices are improving and legacy is being reduced over time. A lot of easy mistakes of the past don't happen so much or at all anymore, and Apple has definitely benefitted long term from the hunt for exploits in hardening their ecosystem. Bugs still exist, but they're not low hanging fruit anymore, they're harder to find and more restricted in scope and more must be chained together for wider access.

dev_dull 8y ago
> No, because these are not symmetric operations. There is nothing mathematically impossible about bug free software. To me this is like saying there’s nothing mathematically impossible about a perfect vacuum. There’s always something leaking energy/attack surface.