6 ms·

You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitud

by mox1 6y ago

You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.) I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.

umvi 6y ago
The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.
- saagarjha 6y ago
  Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.
  - umvi 6y ago
    > Everyone knows that the most secure computer is one that you never turn on An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.
    - saagarjha 6y ago
      If you never turn it on, there can't be anything useful on it ;)
      - umvi 6y ago
        An attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...
  - TeMPOraL 6y ago
    > the job of your security team is to strike a balance that is better than that. There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0]. I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one. -- [0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.
    - whatshisface 6y ago
      Firms in competitive markets don't fight, fighting would be if one firm's products somehow un-manufactured another firm's products. So, the defense industry, and nothing else. They hurt each other's bottom lines, but help society as a whole by collaborating to produce more of whatever it is they're selling.

by mox1 6y ago

umvi 6y ago

The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.

saagarjha 6y ago
Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.
- umvi 6y ago
  > Everyone knows that the most secure computer is one that you never turn on An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.
  - saagarjha 6y ago
    If you never turn it on, there can't be anything useful on it ;)
    - umvi 6y ago
      An attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...
- TeMPOraL 6y ago
  > the job of your security team is to strike a balance that is better than that. There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0]. I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one. -- [0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.
  - whatshisface 6y ago
    Firms in competitive markets don't fight, fighting would be if one firm's products somehow un-manufactured another firm's products. So, the defense industry, and nothing else. They hurt each other's bottom lines, but help society as a whole by collaborating to produce more of whatever it is they're selling.