2 ms·

The issue isn't that Google doesn't make money on intranets. The issue is that the security landscape has gotten so much worse and continues to become more hos

by _jal 6y ago

The issue isn't that Google doesn't make money on intranets. The issue is that the security landscape has gotten so much worse and continues to become more hostile, and private IP address space and a packet filter don't provide nearly as much protection as a lot of people want to think, and attacking internal applications from "outside" is commonplace. The trend towards zero-trust and such is driven more by the fact that there's no such thing has home anymore, at least as far as networks are concerned - there's no realistic way to keep the internet out. And those IoT devices with long-lived security holes are landmines, not assets. I'm much less worried about "long-lived, high value" ones, because those are far more likely to get updates than cheap, fire-and-forget webcams and such. I agree entirely that forward-compatibility is an extremely important consideration. Security, however, frequently pulls in the opposite direction, leaving an unpleasant tradeoff. The trend will not reverse - I don't see how it realistically could. We live in the Red Queen's world.

Silhouette 6y ago
You're arguing that there are no environments now where bad people can't penetrate and roam freely inside the local network? If so, I'm afraid I don't accept that premise at all. Even a basic firewall that accepts no unsolicited incoming traffic is highly effective in environments where you don't need to serve anything to the public Internet from inside your LAN. Between that and keeping software like web browsers and email systems that actively fetch data from outside updated, an average household or small business will be protected reasonably well against most routine threats. The world is far bigger than cloud computing and IoT devices. There must be millions of little in-house web applications someone wrote long ago that are still useful, probably running on some 10-year-old PC in the corner, with some sort of scheduled back-ups if you're lucky. There is also no guarantee that even a high-value, long-lived engineering device manufactured a decade or more ago and still in perfect working order also still has ongoing software support. There is a huge amount of value locked into these old systems, and arbitrarily dismissing their relevance if they don't meet modern security standards that may or may not even be relevant in all the circumstances is like designing a building with such robust security that no-one can get inside, even the owners.

by _jal 6y ago

Silhouette 6y ago

You're arguing that there are no environments now where bad people can't penetrate and roam freely inside the local network? If so, I'm afraid I don't accept that premise at all. Even a basic firewall that accepts no unsolicited incoming traffic is highly effective in environments where you don't need to serve anything to the public Internet from inside your LAN. Between that and keeping software like web browsers and email systems that actively fetch data from outside updated, an average household or small business will be protected reasonably well against most routine threats. The world is far bigger than cloud computing and IoT devices. There must be millions of little in-house web applications someone wrote long ago that are still useful, probably running on some 10-year-old PC in the corner, with some sort of scheduled back-ups if you're lucky. There is also no guarantee that even a high-value, long-lived engineering device manufactured a decade or more ago and still in perfect working order also still has ongoing software support. There is a huge amount of value locked into these old systems, and arbitrarily dismissing their relevance if they don't meet modern security standards that may or may not even be relevant in all the circumstances is like designing a building with such robust security that no-one can get inside, even the owners.