4 ms·

"The idea that we can prevent fires from happening by preventing all sources of ignition in hundreds and hundreds of square miles is completely absurd." That's

"The idea that we can prevent fires from happening by preventing all sources of ignition in hundreds and hundreds of square miles is completely absurd." That's true, but PG&E equipment has started more than 1500 fires between 2014 and 2017. That's over one fire per day. 17 out of the 22 biggest California wildfires in the last 5 years have been started by PG&E: https://outline.com/5bxFLb https://outline.com/5bxFLb Arguably the power shutoff was the right short-term move here: during this wind event 4 fires have been traced back to PG&E (so far), but they had 50 incidents of damaged or downed power lines. It could've been a lot worse. Think of it like buffer overflows in C. It's naive to think that you're going to eliminate all security bugs by any one intervention. However, if one class of bugs is responsible for 80% of breaches, isn't it worth investigating to see what you can do about that one class of bug? Here we have an organization that's responsible for 80% of forest fires: you're not going to eliminate all forest fires by firing its management, but shouldn't you at least investigate and see what they might be doing wrong?

jerf 7y ago
"However, if one class of bugs is responsible for 80% of breaches, isn't it worth investigating to see what you can do about that one class of bug?" Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Arguably, the best solution wouldn't be to try to extinguish the sources of ignition, but greatly increase them so that it's just something that happens all the time. (Another thing they definitely don't share in common with security vulnerabilities.) Of course, the best solution is to hop in a suitably tricked-out De Lorean and start that policy a hundred years ago. The steady-state of this plan is probably pretty nice. However, getting there from here is a real problem. But I'm not sure there's any way around that problem anymore. That's another part of what I mean by "there's already a fire, it just isn't burning yet"; trying to pretend that there's some solution that doesn't involve fire is just fooling oneself. It's only a question of when, not if. If California could be trusted to do something useful with the time, enough so that they get meaningfully ahead of the still-accumulating fuel, "buying time" would be a viable option, but I see very little evidence that anything useful is being done. Links solicited to the contrary; I haven't gone looking. But if the solution is just "try to never ever spark anything and thus The Problem Is Solved!", yeah, that's not a solution. It does nothing to stop the fire-in-waiting from getting bigger.
- dredmorbius 7y ago
  One nit on an otherwise strong explanation: Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. I'd argue that this isn't the case. The threats of Big Data and Big Data Breaches is directly analagous to fuel-load accumulation, with the added bonus of attractive nuisance / induced risk. That is, we're seeing the same class of bugs we've always seen (ignition sources), but the consequences are vastly higher (international finance, national security, organised crime, personal details and blackmail on billions of souls, greatly expanded venues for long-standing frauds). Buffer overflows, viruses, worms, trojans, social engineering, phishing, and MITM all predated the past decade. Advanced-fee fraud, impersonation, Ponzi schemes, etc., all existed previously. Married through high-speed, high-capacity data networks, tied to comprehensive and deep data stores, the whole system is weaponised. And the stakes and consequences are huge. Rather like wildfires in California. By the way, I've got a Mr. Fusion cannister sitting in the garage, interested?
  - jerf 7y ago
    Fair enough... I was speaking in a fairly limited sense where having one security vulnerability in a product doesn't necessarily impact another (assuming they can't be chained) on a single product, but there are dimensions in which it is similar, yes.
    - dredmorbius 7y ago
      Thinking cross-domain on various threats and risks is interesting and useful. I wouldn't have thought of the situation if you'd not made your assertion, so it was useful in that way ;-)
- nostrademons 7y ago
  > Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Security vulnerabilities do have that property: if you find that buffer overflow, you can usually get an RCE, which will let you get root, which will let you compromise the network that the box is on, which will let you find additional vulnerabilities (human or otherwise) to compromise other systems. That's why competent security teams practice defense in depth, and have internal trip-wires and firewalls to limit the damage of any intrusion. That doesn't absolve you from trying to stop the intrusion in the first place. Similarly, getting PG&E to maintain their equipment is not mutually exclusive with other fire mitigation strategies like controlled burns, defensible space, homeowner education, etc. If anything it'll free up resources for those interventions by switching fire departments out of, well, firefighting mode and giving them some breathing space to focus on more long-term practices.

jerf 7y ago

"However, if one class of bugs is responsible for 80% of breaches, isn't it worth investigating to see what you can do about that one class of bug?" Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Arguably, the best solution wouldn't be to try to extinguish the sources of ignition, but greatly increase them so that it's just something that happens all the time. (Another thing they definitely don't share in common with security vulnerabilities.) Of course, the best solution is to hop in a suitably tricked-out De Lorean and start that policy a hundred years ago. The steady-state of this plan is probably pretty nice. However, getting there from here is a real problem. But I'm not sure there's any way around that problem anymore. That's another part of what I mean by "there's already a fire, it just isn't burning yet"; trying to pretend that there's some solution that doesn't involve fire is just fooling oneself. It's only a question of when, not if. If California could be trusted to do something useful with the time, enough so that they get meaningfully ahead of the still-accumulating fuel, "buying time" would be a viable option, but I see very little evidence that anything useful is being done. Links solicited to the contrary; I haven't gone looking. But if the solution is just "try to never ever spark anything and thus The Problem Is Solved!", yeah, that's not a solution. It does nothing to stop the fire-in-waiting from getting bigger.

dredmorbius 7y ago
One nit on an otherwise strong explanation: Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. I'd argue that this isn't the case. The threats of Big Data and Big Data Breaches is directly analagous to fuel-load accumulation, with the added bonus of attractive nuisance / induced risk. That is, we're seeing the same class of bugs we've always seen (ignition sources), but the consequences are vastly higher (international finance, national security, organised crime, personal details and blackmail on billions of souls, greatly expanded venues for long-standing frauds). Buffer overflows, viruses, worms, trojans, social engineering, phishing, and MITM all predated the past decade. Advanced-fee fraud, impersonation, Ponzi schemes, etc., all existed previously. Married through high-speed, high-capacity data networks, tied to comprehensive and deep data stores, the whole system is weaponised. And the stakes and consequences are huge. Rather like wildfires in California. By the way, I've got a Mr. Fusion cannister sitting in the garage, interested?
- jerf 7y ago
  Fair enough... I was speaking in a fairly limited sense where having one security vulnerability in a product doesn't necessarily impact another (assuming they can't be chained) on a single product, but there are dimensions in which it is similar, yes.
  - dredmorbius 7y ago
    Thinking cross-domain on various threats and risks is interesting and useful. I wouldn't have thought of the situation if you'd not made your assertion, so it was useful in that way ;-)
nostrademons 7y ago
> Fires become bigger and bigger the more fuel they accumulate. Security vulnerabilities lack this attribute. Security vulnerabilities do have that property: if you find that buffer overflow, you can usually get an RCE, which will let you get root, which will let you compromise the network that the box is on, which will let you find additional vulnerabilities (human or otherwise) to compromise other systems. That's why competent security teams practice defense in depth, and have internal trip-wires and firewalls to limit the damage of any intrusion. That doesn't absolve you from trying to stop the intrusion in the first place. Similarly, getting PG&E to maintain their equipment is not mutually exclusive with other fire mitigation strategies like controlled burns, defensible space, homeowner education, etc. If anything it'll free up resources for those interventions by switching fire departments out of, well, firefighting mode and giving them some breathing space to focus on more long-term practices.