3 ms·
I mainly blame the market because there's been highly-secure technology for a long time, including some NSA pentesting didn't break during evaluation, that they
by nickpsecurity 8y ago
I mainly blame the market because there's been highly-secure technology for a long time, including some NSA pentesting didn't break during evaluation, that they refuse to use for even their most sensitive stuff. Security is like an after-thought or non-thought in the markets. Many concerned about I.P. thieves even outsource R&D or manufacturing to countries with high, I.P. theft mainly to help executives hit short-term goals for personal profit. They also keep buying and using stuff that's shown to be horribly insecure. They also don't follow good security practices despite being billion dollar businesses. That part will lead to most hacks.
Given this market, anyone developing high-security solutions has to loose money on them constantly or charge exorbitant prices to recover their investment. Pretty much only Defense and regulated sectors will buy those. So, the number of high-security products goes down or stays minimum while easily-hacked garbage grows in number. That's all people see to the point that many buyers don't even know something better is possible. Situation keeps reenforcing itself with the buyers all getting what they're paying for or not guarding against.
So, I blame them as much as the attackers if not more than the attackers when it's the same preventable stuff happening. Especially the times it didn't cost extra or what they bought cost more than secure stuff.
- AlexCoventry 8y ago> some NSA pentesting didn't break during evaluation Which ones? Are any open-source?
- nickpsecurity 8y agoThey're in my Lobsters link in this comment: https://news.ycombinator.com/item?id=18731514 https://news.ycombinator.com/item?id=18731514 Not open source given only proprietary sector made high-assurance security most of the time. There are some groups that open-sourced stuff after the fact. One whose methods some might emulate is Muen separation kernel. They use SPARK Ada to prove it can't have all kinds of problems. It's also smaller than most things like it. https://muen.sk/ https://muen.sk/
- chupasaurus 8y agoThe only time-proven one that I know of is pulling the plug. And even this could be hacked.