3 ms·
It’s still true that most security issues are caused by human ineptitude, not clever vulnerability-hunting or burning sophisticated zero-days.
by snazz 7y ago
It’s still true that most security issues are caused by human ineptitude, not clever vulnerability-hunting or burning sophisticated zero-days.
- eli 7y agoI would replace "human ineptitude" with "flawed system design that makes it very easy to make very bad mistakes"
- snazz 7y agoThat's a valid way to categorize all memory errors in C.
- eli 7y agoAnd I think we should absolutely hold that against C as a development language.
- mtgx 7y agoNot sure why you're downvoted. It's pretty clear that when a lot of people make "dumb mistakes" despite the solution being "obvious", it's because a flawed system design. Look at the simplest analogy to this - the opt-out/opt-in buttons. If something is opt-out by default, then most people will leave it that way, even if they have no good reason to leave it is. And advertising companies like Google and Facebook take full advantage of this.
- dragonwriter 7y agoBut is the flawed system design here the automated system at AWS or the human-in-the-loop systems by which companies are providing admin access to IT resources, including AWS accounts?
- eli 7y agoProbably both! But I would argue that below a certain size provisioning things by hand probably makes sense. A UI that makes it too easy to make a private thing public is never ok.
- dragonwriter 7y agoSure, but I don't think the current EC2 UI makes it too easy (and the S3 UI could only make it harder by not making public and cross account access possible at all.)
- notabee 7y ago"a common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools" - Douglas Adams
- ryacko 7y agoOnce I mentioned on a mailing list Chrome’s reaction to mouse driver bug on my computer, it would buffer JavaScript events, and process it even for pages on a different domain. Later I told the EFF I had a suspicion that iOS didn’t rate limit input events to the lock screen, independently a research found out about it a month later. Even if there are zero days, I don’t think finding them is a particularly noteworthy or rewarding task.