4 ms·
The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricit
by umvi 7y ago
The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff.
Yes, I get we live in a world where bad people take advantage of others, making security necessary.
But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist.
> My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for.
By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.
- saagarjha 7y agoSecurity is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.
- umvi 7y ago> Everyone knows that the most secure computer is one that you never turn on An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.
- saagarjha 7y agoIf you never turn it on, there can't be anything useful on it ;)
- umvi 7y agoAn attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...
- TeMPOraL 7y ago> the job of your security team is to strike a balance that is better than that. There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0]. I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one. -- [0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.
- whatshisface 7y agoFirms in competitive markets don't fight, fighting would be if one firm's products somehow un-manufactured another firm's products. So, the defense industry, and nothing else. They hurt each other's bottom lines, but help society as a whole by collaborating to produce more of whatever it is they're selling.
- TeMPOraL 7y ago> fighting would be if one firm's products somehow un-manufactured another firm's products They absolutely do, and would do it much more if most ways of doing that weren't strictly illegal. A particularly notorious, legal way of unmanufacturing your competitor's product is when both yours and theirs rely on a common component - so you can buy out the entire supply of that component to prevent your competitor from releasing a similar product after you. Off the top of my head, Apple did that with these mini hard drives for iPods. A more common example of fighting is advertising, which becomes a zero-sum game when the market for a product category saturates.