2 ms·
The salary of the engineer who built it. If you hire those security engineers, you can give them access to the source code. If you didn't hire them, there is n
by maxbond 7y ago
The salary of the engineer who built it.
If you hire those security engineers, you can give them access to the source code. If you didn't hire them, there is no way to tell benign attackers from other attackers, and they can deal. It probably won't give them much trouble anyway. :)
- saagarjha 7y ago> If you didn't hire them, there is no way to tell benign attackers from other attackers, and they can deal. The better way to deal with this is to make your firmware secure regardless of whether someone can pull it off your device. Making security engineers’ lives difficult just means that you’ll find out about bugs from the news when they’re being sold to authoritarian countries to suppress dissents rather than the paper on firmware security that a graduate student was going to write before they decided to move to a much nicer platform.
- maxbond 7y agoThis is baffling to me for two reasons. The first is that my thesis is explicitly that this is not a defense and is not an excuse for poor memory handling etc. in your firmware. (And the more I invest in creating a robust firmware, the more I stand to lose if someone rips off my product & undercuts me - security risks are not the only type of risk.) The second is that the notion that I should rely on the charity of unpaid graduate students to discover bugs in my firmware is both inequitable and unsound.