5 ms·

The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuil

The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuild can be OK. Some downtime can be OK. It depends on the system. To put it eloquently: I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup

tinus_hn 7y ago
Also the defeatist ‘everything can be hacked if they try hard enough’ attitude, applied as a defense.
- pdpi 7y ago
  I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need? As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers at 5?).
  - tinus_hn 7y ago
    That is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.
    - pdpi 7y ago
      Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative. Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.
Koshkin 7y ago
Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.
- umvi 7y ago
  Qualcomm is like this. Their developer workstations are ultra locked down. If you so much as plug in a flash drive, alarms will start going off. If you email them a file, any attachments are instantly quarentined. While I was there it was extremely difficult to transfer a log file from one of their workstations to my laptop for analysis during a debug session. It was also extremely difficult getting new builds into the setup since there was no easy way to get the binary file into their workstations.
  - xorfish 7y ago
    I guess you could have used a private nextcloud instance to transfer it.
    - swinglock 7y ago
      I guess in such a locked down environment that would be grounds for termination.
      - xorfish 7y ago
        The point is more that all that "data loss prevention" stuff will not prevent someone who has access to the network to get data out.
- arethuza 7y ago
  I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure. Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure between production and the production-1 environment. The application being tested generated zillions of emails using "real" email addresses that clogged up their production environment.
umvi 7y ago
> I don't trust security people to do sane things Seriously. Security decisions that demolish UX can tank entire products. Recent-ish example: Oracle VirtualBox. Used to love that software and I would recommend it to friends needing VMs. They added a new hardening feature that makes it unusable on my setup for whatever reason (VMs fail to start with "hardening failures"). There is no option to disable the hardening feature short of going into the source code figuring out how to disable it and building from scratch[1]. It's like geez, I don't even care about hardening - I'm not trying to analyze stuxnet or some ransomware virus here, I just want to work on my web app in between classes at school on my windows laptop. There's a massive FAQ on the VirtualBox forums on how to debug hardening failures[2]. I spent about 5 hours working through the FAQ and troubleshooting before I just said "screw this" and bought VMWare which worked perfectly first try. I no longer recommend VirtualBox to friends - I tell them it will likely give them headaches and to use VMWare or WSL instead. [1] https://forums.virtualbox.org/viewtopic.php?f=6&t=84523 https://forums.virtualbox.org/viewtopic.php?f=6&t=84523 [2] https://forums.virtualbox.org/viewtopic.php?f=25&t=82106 https://forums.virtualbox.org/viewtopic.php?f=25&t=82106 [3] https://forums.virtualbox.org/viewtopic.php?f=1&t=62897 https://forums.virtualbox.org/viewtopic.php?f=1&t=62897 Note: [3] is actually pretty entertaining thread with insane security people defending the new terrible hardening issues of VirtualBox.
- sekh60 7y ago
  Just curious if you have considered migrating from VirtualBox to Hyper-V given you are doing your work on a Windows laptop.
  - umvi 7y ago
    No, actually I had somehow never heard of Hyper-V before today (or maybe I had but for some reason it didn't click it was software I could make VMs with). Great suggestion, I'll look into it.
    - hermitdev 7y ago
      Definitely give Hyper-V a shot. I've been using it at home and work since Windows 8. I had a lot of issues with VirtualBox and networking (I could never SSH into a VM from the host working, for example). In Hyper-V, all you need to do is setup a virtual switch and the host and VM can talk to each other just fine. Hyper-V just works. I've got Linux and Windows VMs and have never had a problem with either (as far as virtualization goes). I use it less frequently now that Win10 has WSL & WSL 2, though (although WSL 2 uses a lightweight VM on Hyper-V).

tinus_hn 7y ago

Also the defeatist ‘everything can be hacked if they try hard enough’ attitude, applied as a defense.

pdpi 7y ago
I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need? As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers at 5?).
- tinus_hn 7y ago
  That is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.
  - pdpi 7y ago
    Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative. Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.

Koshkin 7y ago

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

umvi 7y ago
Qualcomm is like this. Their developer workstations are ultra locked down. If you so much as plug in a flash drive, alarms will start going off. If you email them a file, any attachments are instantly quarentined. While I was there it was extremely difficult to transfer a log file from one of their workstations to my laptop for analysis during a debug session. It was also extremely difficult getting new builds into the setup since there was no easy way to get the binary file into their workstations.
- xorfish 7y ago
  I guess you could have used a private nextcloud instance to transfer it.
  - swinglock 7y ago
    I guess in such a locked down environment that would be grounds for termination.
    - xorfish 7y ago
      The point is more that all that "data loss prevention" stuff will not prevent someone who has access to the network to get data out.
arethuza 7y ago
I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure. Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure between production and the production-1 environment. The application being tested generated zillions of emails using "real" email addresses that clogged up their production environment.

umvi 7y ago

> I don't trust security people to do sane things Seriously. Security decisions that demolish UX can tank entire products. Recent-ish example: Oracle VirtualBox. Used to love that software and I would recommend it to friends needing VMs. They added a new hardening feature that makes it unusable on my setup for whatever reason (VMs fail to start with "hardening failures"). There is no option to disable the hardening feature short of going into the source code figuring out how to disable it and building from scratch[1]. It's like geez, I don't even care about hardening - I'm not trying to analyze stuxnet or some ransomware virus here, I just want to work on my web app in between classes at school on my windows laptop. There's a massive FAQ on the VirtualBox forums on how to debug hardening failures[2]. I spent about 5 hours working through the FAQ and troubleshooting before I just said "screw this" and bought VMWare which worked perfectly first try. I no longer recommend VirtualBox to friends - I tell them it will likely give them headaches and to use VMWare or WSL instead. [1] https://forums.virtualbox.org/viewtopic.php?f=6&t=84523 https://forums.virtualbox.org/viewtopic.php?f=6&t=84523 [2] https://forums.virtualbox.org/viewtopic.php?f=25&t=82106 https://forums.virtualbox.org/viewtopic.php?f=25&t=82106 [3] https://forums.virtualbox.org/viewtopic.php?f=1&t=62897 https://forums.virtualbox.org/viewtopic.php?f=1&t=62897 Note: [3] is actually pretty entertaining thread with insane security people defending the new terrible hardening issues of VirtualBox.

sekh60 7y ago
Just curious if you have considered migrating from VirtualBox to Hyper-V given you are doing your work on a Windows laptop.
- umvi 7y ago
  No, actually I had somehow never heard of Hyper-V before today (or maybe I had but for some reason it didn't click it was software I could make VMs with). Great suggestion, I'll look into it.
  - hermitdev 7y ago
    Definitely give Hyper-V a shot. I've been using it at home and work since Windows 8. I had a lot of issues with VirtualBox and networking (I could never SSH into a VM from the host working, for example). In Hyper-V, all you need to do is setup a virtual switch and the host and VM can talk to each other just fine. Hyper-V just works. I've got Linux and Windows VMs and have never had a problem with either (as far as virtualization goes). I use it less frequently now that Win10 has WSL & WSL 2, though (although WSL 2 uses a lightweight VM on Hyper-V).