7 ms·
How do you get around the network-effect benefits of large cultures? While more vulnerable by being larger (and a more attractive target), these cultures also d
by iwr 16y ago
How do you get around the network-effect benefits of large cultures? While more vulnerable by being larger (and a more attractive target), these cultures also develop self-defense mechanisms and an ecosystem of support.
While a custom culture may be safer from wide scale attacks, it's still more vulnerable to targeted attacks. If you're a bank and you rely on security-by-obscurity you are in greater danger than if using a tested and documented standard system.
As an aside, the potato famine was not caused by a singular condition. The law of the land up to some time before the famine prohibited the purchase of land by Catholics; only about 7% of the agricultural land was actually in the hands of the Irish. This meant the vast majority of them were serfs to English lords and had to rely on small/fragmented patches of land to feed themselves. The reason potatoes were grown was that no other crops could be grown on these small plots. In the absence of potatoes, people would have been starving much sooner.
- tptacek 16y agoYour second point is one of the original criticisms of the monoculture idea: Macs are both safer and less secure because they're a low-profile target. Give them 50% of the desktop market share and they'll be as bad as WinAPI. There will never be enough operating environments to provide true diversity. Say there are ten end-user platforms (there are 5-6 now, including iOS and Android) each with a roughly comparable share. Each platform now has 3MM units --- a totally viable susceptible population for malware --- but only 1/10th as much security attention. It may actually be the case that the opposite of the monoculture paper is true, and that we made it through the 2000's without melting down completely because we basically delegated software security to Microsoft, which stepped up to handle it.
- EdiX 16y agoOn the other hand we may have been just lucky, we have had an infection of upwards of 10 million systems of unknown size, origin and purposes, but fortunately its owners decided to not use it.
- jdp23 16y agoA rare subject on with 'tptacek and I agree! Not long after the original monoculture paper came out, there was a buffer overrun in a software firewall, and the 11,000 infected machines generated enough traffic that it messed up a lot of the internet. To me this really highlighted problems both with the superficiality of model in the paper and the limitations of the biological metaphor. That said I did think the paper was very valuable at putting the discussion on the table. Some of the risks of monoculture are very real. I was on a National Academy of Sciences panel at the time with Charles Parrow (whose book Marcus Ranum approvingly cites, although Charles actually agreed with Bruce) and we spent a lot of time discussing the arguments for and against.
- lukeschlather 16y agoIf anyone stepped up to handle it, it was McAfee and Norton/Symantec. And they really didn't do a very good job. Really, the sysadmins of the world were doing most of the heavy lifting.
- tptacek 16y agoThere's "handling", and then there's "vampirism".
- lukeschlather 16y agoI once used Norton's tools to remove an infection from a machine, when nothing else would work. Nowadays I would of course get the data off and wipe the machine, but this was when I was younger and storage was not so cheap and plentiful as it is now. They have definitely done some small measure of good in securing the Windows ecosystem, and in the first half of the last decade, they did far more than Microsoft.
- jdp23 16y agototally agreed about the sysadmins. i think there's lots of people who deserve credit for stepping up to try to handle it -- security researchers, Linux folks, and yes Microsoft (things really did change starting in 2001 or so, although of course there's still room for improvement). sysadmins are at the top of my list though and don't get anywhere neary the credit they deserve
- SriniK 16y agoThe reason we made it through the 2000's includes huge contributions from crypto society. I can't imagine how we would be without public release of SHA/RSA/AES/PGP/... As you said, we have to commend MSFT for stepping up on security, being a clear winner of the os race.
- tptacek 16y agoWow, do we ever disagree on that one. SHA, RSA, and AES have caused more harm than good, modulo the one very specific massive win of SSL/TLS.
- SriniK 16y agoThat is an interesting comment. How did SHA/RSA/AES cause more harm? Every other web developer has to use SHA for one thing or the other. SSL is the application of RSA.
- tptacek 16y agoSSL is the application of RSA like a pebble bed nuclear reactor is the application of radioactivity. Every-other-web-developer's use of SHA has created vulnerabilities, from crappy password hashes through poorly-considered URL authentication schemes that have blown up on extremely well-funded teams (see: Amazon and Flickr). Just like that Boy Scout who figured out how to extract uranium from old clocks and gas lanterns, most of the time, when lay developers try to build something with cryptography, all that happens is that a team of people in hazmat gear have to come clean up the mess.
- SriniK 16y agoIt's like you are saying though tools are good but because ignorant people use it, tools must be bad. This is the classic example of 'fools blame their tools'. AES/SHA/RSA are really good tools and great asset for crypto community.
- 16y ago