4 ms·

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need prot

Buggy drivers are a problem, but if you control the hardware, it's your responsibility to vet what you plug into it. It's like with door locks: if you need protection from advanced thieves you'll need to go through some extra hoops anyway. You could petition OS manufacturers to focus more on physical security, but there's limits to what you can do without piles of abstractions (ala smart phone security)

gowld 8y ago
A human cannot vet an electronic device. We can only interface to it from another electronic device. The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.
- peterwwillis 8y ago
  Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.
TheDong 8y ago
> it's your responsibility to vet what you plug into it Okay, please explain a little more. I'll give you a concrete example of a device to work with. Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model. How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.
- 781 8y ago
  If security is so important to you, you buy a $100 laptop, put the stick in it, get the files and upload them somewhere then burn the laptop and stick. Or just go to an "Internet Cafe" and do it there.

gowld 8y ago

A human cannot vet an electronic device. We can only interface to it from another electronic device. The same argument applies to the Internet -- we don't say that it's the human's responsibility to vet every website or email message before we let our computer connect to it. We expect our computer to do that. That's why it was wrong for Outlook to automatically execute every program sent to you via email.

peterwwillis 8y ago
Your computer isn't vetting things it gets from the internet at all, with the exception of TLS certs and anti-virus scanning. Virtually all other operations done with remote content are unvetted; it's play & pray. You clicking a button is the only vetting process.

TheDong 8y ago

> it's your responsibility to vet what you plug into it Okay, please explain a little more. I'll give you a concrete example of a device to work with. Last week I accidentally left my usb flash drive at a coffee shop with some important files on it. When I went back, the coffee shop had it in the lost and found. It looks the same on the outside, but it's a mass-produced model. How do a vet this hardware before plugging it into my computer? I do need to access the files on it, but also attackers may have had access to it for several hours.

781 8y ago
If security is so important to you, you buy a $100 laptop, put the stick in it, get the files and upload them somewhere then burn the laptop and stick. Or just go to an "Internet Cafe" and do it there.