4 ms·

A deeper issue is how hard it is to "know" if companies hawking products with security implications (which is nearly everything, today) are lying. I'm not even

by _jal 6y ago

A deeper issue is how hard it is to "know" if companies hawking products with security implications (which is nearly everything, today) are lying. I'm not even talking about the gradient ranging from innocent bugs to incompetent coders and how that gets papered over. When you buy shoddy physical goods, there are typically characteristics you can't hide, like cheap materials. But with software like this of course the only function your average person can verify is that the transmission happens, not how it is encoded. Neither Grandma nor your manager are likely to break out tcpdump to check. And of course the DMCA complicates this in the US, and things are even worse for researchers elsewhere. Third party audit and reputation are the only fixes I see. And the second one requires a commercial environment that rewards it. The current one doesn't; it rewards novelty and lies, so that's what we get.

okprod 6y ago
Freely licensed software would allow for audits.
- ineedasername 6y ago
  As long as you audit both the software and the implementation.
phone8675309 6y ago
Any software you don't have the source for, haven't built yourself, and don't host yourself is immediate suspect. Third party audits aren't a silver bullet. Enron and Worldcom had third party audits.
- forgotmypw17 6y ago
  I agree. I am writing my project a certain way to achieve a goal I call reimplementability. This means that I try to design in such a way that a reasonably competent dev could sit down and rewrite the whole system in a couple hours/days/weeks.
- _jal 6y ago
  I completely agree, and that's a huge topic unto itself. Briefly, the issue with auditing, as with most things, is incentives over time. The difference between fraud in finance and software engineering is how long the bezzle[1] lasts. In finance, it can last a very long time in up economies, leaving Big Three auditors plenty of time to scurry off. In software you have to deliver at some point, leaving lying auditors exposed to discovery by security researchers immediately. There is certainly still room for shenanigans if not set up correctly, but less than in finance. [1] https://moneyfyi.wordpress.com/2013/11/15/5358/ https://moneyfyi.wordpress.com/2013/11/15/5358/
- ineedasername 6y ago
  You're right, but 3rd party audits can help, especially because the precedent set by Arthur Andersen w/ Enron. It destroyed their business completely when their fraud was discovered, so there would be a strong incentive for auditors to get it right. As you said, not a silver bullet, but it's a step up from nothing.
  - yourapostasy 6y ago
    > It destroyed their business completely when their fraud was discovered... I suppose rebranding and transferring assets is kind of like a Chapter 7 "destroyed their business completely", but no one involved went to jail, no one lost their Series 7 or any other kind of licensing, no one was ever barred for life from ever managing at a public company ever again, etc. Sure, to laypeople a selling off of assets and rebranding sounds pretty "destroyed...completely", but unless there are lifelong, severe, natural person repercussions, business people are thrilled with the results. No clawbacks, no offender registration, can always point the blame elsewhere in future discussions (like job interviews). This is mostly regulatory theater, and all net upside for those who benefited by unethical action or by unethical omission.
    - ineedasername 6y ago
      Well, you make good points. I can't argue with that.
  - bigbubba 6y ago
    > Firms That Imploded Have Something in Common: Ernst and Young Audited Them https://www.wsj.com/articles/string-of-firms-that-imploded-have-something-in-common-ernst-young-audited-them-11602863319 https://www.wsj.com/articles/string-of-firms-that-imploded-h... https://news.ycombinator.com/item?id=24802741 https://news.ycombinator.com/item?id=24802741 Nobody at Arthur Andersen went to prison and SCOTUS reversed their conviction. The firm may have gone up in smoke, but nobody was actually punished for their crimes. Who at Ernst and Young has gone to prison for Wireguard or WeWork? None by my count.
    - 6y ago
- LinuxBender 6y ago
  Auditors operate off money, too. I have seen this first hand. If I tell them about an egregious violation and they don't even bother to write it down, I know what type of "auditor" I am dealing with. If they write it down and the issue is not resolved, same thing.
- eru 6y ago
  > [...] haven't built yourself, [...] Reproducible builds remove this requirement. https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds
123randomacc 6y ago
How 'hard it is to "know"' is irreverent, and you agree to this when you accept the 'contract'. This isn't an issue of honesty, in fact; quite the contrary. They are extremely honest. It's just in the fine print. Legal / Terms of Service / Terms of Use / Usage Policy I find that a majority don't even hide unreasonable conditions in 'legal' terms anymore. Whilst there may be tens, hundreds, of pages in that ToS you tick before using the product - there's a few solid, clear, one sentence dot points that protect from all issues. The best of these is similar to: "We reserve the right to amend, change, or otherwise modify this agreement with - or without - notice.", or "We reserve the right to withdraw services/solutions with - or without - notice." Some, like the famous early React licenses (by Facebook), had indemnity clauses for simply using the product - even if your then legal engagement was entirely unrelated to your use of React. Impacted by Cambridge Analytica? Sorry. Many years ago you experimented with React. Immunity. I don't think a third party audit is a fix. Even dismissing these previous statements. The volume of 'independent' auditors that are then found corrupt, or otherwise bias/incompetent in result, is pretty regular news. More often than not. Based on some experience with how contracts and engagements go with big corporations - some even factor in known 'expected losses' (such as fines, failing to meet SLA, etc) in their actual budget of contract. The real fix is users taking responsibility. Don't like the ToS (And, believe me; you won't..). Don't accept it. (@USERS, not @_jal) But don't complain that the product you did, or did not, pay a cent for - but blindly accepted the ToS - fails to deliver to your expectation. Sure.. It suggested, or possibly even states 'end to end encryption'. But the ToS clarifies context of that. https://zoom.us/terms https://zoom.us/terms
- BlueTemplar 6y ago
  ToS are regularly found to be legally void by courts.

by _jal 6y ago

okprod 6y ago

Freely licensed software would allow for audits.

ineedasername 6y ago
As long as you audit both the software and the implementation.

phone8675309 6y ago

Any software you don't have the source for, haven't built yourself, and don't host yourself is immediate suspect. Third party audits aren't a silver bullet. Enron and Worldcom had third party audits.

forgotmypw17 6y ago
I agree. I am writing my project a certain way to achieve a goal I call reimplementability. This means that I try to design in such a way that a reasonably competent dev could sit down and rewrite the whole system in a couple hours/days/weeks.
_jal 6y ago
I completely agree, and that's a huge topic unto itself. Briefly, the issue with auditing, as with most things, is incentives over time. The difference between fraud in finance and software engineering is how long the bezzle[1] lasts. In finance, it can last a very long time in up economies, leaving Big Three auditors plenty of time to scurry off. In software you have to deliver at some point, leaving lying auditors exposed to discovery by security researchers immediately. There is certainly still room for shenanigans if not set up correctly, but less than in finance. [1] https://moneyfyi.wordpress.com/2013/11/15/5358/ https://moneyfyi.wordpress.com/2013/11/15/5358/
ineedasername 6y ago
You're right, but 3rd party audits can help, especially because the precedent set by Arthur Andersen w/ Enron. It destroyed their business completely when their fraud was discovered, so there would be a strong incentive for auditors to get it right. As you said, not a silver bullet, but it's a step up from nothing.
- yourapostasy 6y ago
  > It destroyed their business completely when their fraud was discovered... I suppose rebranding and transferring assets is kind of like a Chapter 7 "destroyed their business completely", but no one involved went to jail, no one lost their Series 7 or any other kind of licensing, no one was ever barred for life from ever managing at a public company ever again, etc. Sure, to laypeople a selling off of assets and rebranding sounds pretty "destroyed...completely", but unless there are lifelong, severe, natural person repercussions, business people are thrilled with the results. No clawbacks, no offender registration, can always point the blame elsewhere in future discussions (like job interviews). This is mostly regulatory theater, and all net upside for those who benefited by unethical action or by unethical omission.
  - ineedasername 6y ago
    Well, you make good points. I can't argue with that.
- bigbubba 6y ago
  > Firms That Imploded Have Something in Common: Ernst and Young Audited Them https://www.wsj.com/articles/string-of-firms-that-imploded-have-something-in-common-ernst-young-audited-them-11602863319 https://www.wsj.com/articles/string-of-firms-that-imploded-h... https://news.ycombinator.com/item?id=24802741 https://news.ycombinator.com/item?id=24802741 Nobody at Arthur Andersen went to prison and SCOTUS reversed their conviction. The firm may have gone up in smoke, but nobody was actually punished for their crimes. Who at Ernst and Young has gone to prison for Wireguard or WeWork? None by my count.
  - 6y ago
LinuxBender 6y ago
Auditors operate off money, too. I have seen this first hand. If I tell them about an egregious violation and they don't even bother to write it down, I know what type of "auditor" I am dealing with. If they write it down and the issue is not resolved, same thing.
eru 6y ago
> [...] haven't built yourself, [...] Reproducible builds remove this requirement. https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds

123randomacc 6y ago

How 'hard it is to "know"' is irreverent, and you agree to this when you accept the 'contract'. This isn't an issue of honesty, in fact; quite the contrary. They are extremely honest. It's just in the fine print. Legal / Terms of Service / Terms of Use / Usage Policy I find that a majority don't even hide unreasonable conditions in 'legal' terms anymore. Whilst there may be tens, hundreds, of pages in that ToS you tick before using the product - there's a few solid, clear, one sentence dot points that protect from all issues. The best of these is similar to: "We reserve the right to amend, change, or otherwise modify this agreement with - or without - notice.", or "We reserve the right to withdraw services/solutions with - or without - notice." Some, like the famous early React licenses (by Facebook), had indemnity clauses for simply using the product - even if your then legal engagement was entirely unrelated to your use of React. Impacted by Cambridge Analytica? Sorry. Many years ago you experimented with React. Immunity. I don't think a third party audit is a fix. Even dismissing these previous statements. The volume of 'independent' auditors that are then found corrupt, or otherwise bias/incompetent in result, is pretty regular news. More often than not. Based on some experience with how contracts and engagements go with big corporations - some even factor in known 'expected losses' (such as fines, failing to meet SLA, etc) in their actual budget of contract. The real fix is users taking responsibility. Don't like the ToS (And, believe me; you won't..). Don't accept it. (@USERS, not @_jal) But don't complain that the product you did, or did not, pay a cent for - but blindly accepted the ToS - fails to deliver to your expectation. Sure.. It suggested, or possibly even states 'end to end encryption'. But the ToS clarifies context of that. https://zoom.us/terms https://zoom.us/terms

BlueTemplar 6y ago
ToS are regularly found to be legally void by courts.