3 ms·

Bridge engineers don't have to fear the progress of science working against them, but computer security is not alone here. Consider designing body armor or mili

Bridge engineers don't have to fear the progress of science working against them, but computer security is not alone here. Consider designing body armor or military aircraft and hoping that the state of the art will stay the same! An adversary who can use the progress of science against you is always dangerous. Computer security has been rather lucky so far: the asymmetry between hashing and cracking a hash, for example, is much more favorable to the defense than the balance between bulletproof vests and bullets.

jtmarmon 7y ago
The problem is that the expectations of software are much more akin to the expectations of a bridge than those of a bulletproof vest
WorldMaker 7y ago
On a long enough time scale Bridge Engineers still have to worry about decay, entropy, collisions. Some of that can even be attributed to the "progress of science", as bridges have collapsed because earlier assumptions were invalidated by larger trucks, for instance. An issue so far for computer security is less that decay and entropy happen, but that they happen so fast that the timescales are decades or even years rather than lifetimes.
- candu 7y ago
  This is a great point in general: sometimes the problem isn't an adversary using knowledge in your field against you, it's the unintended consequences of progress / changes in adjacent fields. It also underscores that, when dealing with things like passwords, it's helpful to be able to seamlessly upgrade to more robust methods down the line, e.g. "if this password hash was generated using the old method, check the login using that method but rehash and update the database using the new method after authentication."
microtherion 7y ago
> Consider designing body armor or military aircraft and hoping that the state of the art will stay the same! This was particularly a problem for castles vs. the progress of artillery, because those were supposed to have a rather long lifetime.

jtmarmon 7y ago

The problem is that the expectations of software are much more akin to the expectations of a bridge than those of a bulletproof vest

WorldMaker 7y ago

On a long enough time scale Bridge Engineers still have to worry about decay, entropy, collisions. Some of that can even be attributed to the "progress of science", as bridges have collapsed because earlier assumptions were invalidated by larger trucks, for instance. An issue so far for computer security is less that decay and entropy happen, but that they happen so fast that the timescales are decades or even years rather than lifetimes.

candu 7y ago
This is a great point in general: sometimes the problem isn't an adversary using knowledge in your field against you, it's the unintended consequences of progress / changes in adjacent fields. It also underscores that, when dealing with things like passwords, it's helpful to be able to seamlessly upgrade to more robust methods down the line, e.g. "if this password hash was generated using the old method, check the login using that method but rehash and update the database using the new method after authentication."

microtherion 7y ago

> Consider designing body armor or military aircraft and hoping that the state of the art will stay the same! This was particularly a problem for castles vs. the progress of artillery, because those were supposed to have a rather long lifetime.