5 ms·

Isn't that what security researchers are supposed to do? Find the most implausible-sounding attacks, get them to work at least some of the time? I would not be

by geofft 7y ago

Isn't that what security researchers are supposed to do? Find the most implausible-sounding attacks, get them to work at least some of the time? I would not be reassured by someone telling me "well, most of the time, there's too much noise to get a reliable side channel out of Spectre."

pour778yy 7y ago
What does it matter when Facebook, Equifax and the like are let off the hook anyway? We know they’re selling the data anyway? So it’s not privacy we’re protecting but corporate bottom lines (if everyone has it the data has less value). There is no truly secure computer system because there is no security from laws of nature and human avarice. There’s always a relative position from which one can get the data they need. The best security we have is competent, functioning government diffusing and negotiating stable arrangements. IMO we’ve pushed too many paranoias from social norms into products we build. Your data isn’t secure and there is no changing that. And really the data isn’t THAT valuable. We’re just excited by a new level of granularity. This is promises of “nuclear powered rocket cars” all over again. Sure there’s some novelty coming from it in scientific realms, but it’s largely useless to day to day life (only a truly lazy person can’t be bothered to phone call in their hair appointments). Steve Bannon got all !! over data showing people that live by a church.... go to the church. Pretty sure that was already well known. That’s the sort of “value” we’re achieving with all this big data. Obvious answers we’re already familiar with. Cause there are few interesting questions left to be asked about us in a context of “who are we in daily life.”
madez 7y ago
Indeed. And a today barely usable weakness can be tomorrows glaringly exploitable security hole. If we are aware of the problems, we can at least make sure to not make them bigger.
gwern 7y ago
"Attacks only get better", as they say.
tedunangst 7y ago
If only there was some way to calculate the potential bandwidth of a channel.
locacorten 7y ago
The main trait of a top researcher is skepticism -- the willingness to doubt results. You learn to be skeptical as part of the training during your Ph.D. Unfortunately, the standards have fallen. The security community is one of the worst instances of the lack of skepticism in the science arena. The community has started to reward clickbaity papers because they "sell". It's a race to the bottom.
- jnwatson 7y ago
  A security research does not have to develop an entire exploit to demonstrate a vulnerability. This is analogous to that. It is valuable research if someone can take it to the next step. Inasmuch, it is definitely worthy of publishing.
- jackpirate 7y ago
  Security researchers should be much more skeptical of claims that a system is safe than they should about claims that a system is unsafe. The default posture of accepting that all reputable claims about a system being unsafe are true is probably not too bad of a one to have.
- Spooky23 7y ago
  Security is tough because you a mix of complete idiots trolling for attention, business, or jobs, vendors seeking fud to drive sales, and incredibly talented people reverse engineering and discovering things. I suspect that some the worst are seeded and encouraged by parties who benefit from a lack of trust in research and maximum chaos.
  - locacorten 7y ago
    Great point. But there should be a distinction between academic conferences where professors from U. Mich are publishing and practitioner conferences aimed at industry (including sales, etc.). My criticism is about academic conferences -- there's little skepticism left when reviewing papers describing attacks. As long as it's cool, it's in. Look at the title above: "Hard Drive of Hearing: Disks that Eavesdrop...". It's not far off from the headlines on CNN or Fox News. At this rate, I predict by 2025 we'll have Breaking News red banners on academic conferences sites. Let me re-assure everyone out there ... No, your disks are not eavesdropping. Disks eavesdropping should be the least of your worries security-wise.

by geofft 7y ago

pour778yy 7y ago

What does it matter when Facebook, Equifax and the like are let off the hook anyway? We know they’re selling the data anyway? So it’s not privacy we’re protecting but corporate bottom lines (if everyone has it the data has less value). There is no truly secure computer system because there is no security from laws of nature and human avarice. There’s always a relative position from which one can get the data they need. The best security we have is competent, functioning government diffusing and negotiating stable arrangements. IMO we’ve pushed too many paranoias from social norms into products we build. Your data isn’t secure and there is no changing that. And really the data isn’t THAT valuable. We’re just excited by a new level of granularity. This is promises of “nuclear powered rocket cars” all over again. Sure there’s some novelty coming from it in scientific realms, but it’s largely useless to day to day life (only a truly lazy person can’t be bothered to phone call in their hair appointments). Steve Bannon got all !! over data showing people that live by a church.... go to the church. Pretty sure that was already well known. That’s the sort of “value” we’re achieving with all this big data. Obvious answers we’re already familiar with. Cause there are few interesting questions left to be asked about us in a context of “who are we in daily life.”

madez 7y ago

Indeed. And a today barely usable weakness can be tomorrows glaringly exploitable security hole. If we are aware of the problems, we can at least make sure to not make them bigger.

gwern 7y ago

"Attacks only get better", as they say.

tedunangst 7y ago

If only there was some way to calculate the potential bandwidth of a channel.

locacorten 7y ago

The main trait of a top researcher is skepticism -- the willingness to doubt results. You learn to be skeptical as part of the training during your Ph.D. Unfortunately, the standards have fallen. The security community is one of the worst instances of the lack of skepticism in the science arena. The community has started to reward clickbaity papers because they "sell". It's a race to the bottom.

jnwatson 7y ago
A security research does not have to develop an entire exploit to demonstrate a vulnerability. This is analogous to that. It is valuable research if someone can take it to the next step. Inasmuch, it is definitely worthy of publishing.
jackpirate 7y ago
Security researchers should be much more skeptical of claims that a system is safe than they should about claims that a system is unsafe. The default posture of accepting that all reputable claims about a system being unsafe are true is probably not too bad of a one to have.
Spooky23 7y ago
Security is tough because you a mix of complete idiots trolling for attention, business, or jobs, vendors seeking fud to drive sales, and incredibly talented people reverse engineering and discovering things. I suspect that some the worst are seeded and encouraged by parties who benefit from a lack of trust in research and maximum chaos.
- locacorten 7y ago
  Great point. But there should be a distinction between academic conferences where professors from U. Mich are publishing and practitioner conferences aimed at industry (including sales, etc.). My criticism is about academic conferences -- there's little skepticism left when reviewing papers describing attacks. As long as it's cool, it's in. Look at the title above: "Hard Drive of Hearing: Disks that Eavesdrop...". It's not far off from the headlines on CNN or Fox News. At this rate, I predict by 2025 we'll have Breaking News red banners on academic conferences sites. Let me re-assure everyone out there ... No, your disks are not eavesdropping. Disks eavesdropping should be the least of your worries security-wise.