5 ms·

This is kind of horrifying. I find myself often coming to the conclusion that our increasing tangle of software dependencies is a massive liability to society.

by titzer 6y ago

This is kind of horrifying. I find myself often coming to the conclusion that our increasing tangle of software dependencies is a massive liability to society. Suddenly code that was never designed to be "load-bearing"--intended to be part of a critical system, written in a hurry to glue together two components, or written for maximum performance and not maximum security, or code without proper tests, without quality control, code review, code written by hobbyists--finds itself into critical systems. And our amazing ability to constantly zoom out and plug and reuse software in huge amounts leads to this giant tangle of dependencies where everything is needed to get everything off the ground. And suddenly a JPEG vulnerability [1] leads to remote code execution. I don't know what the answer is, but I don't feel super great about the future, given the giant sinkhole of dependencies that everything seems to be getting sucked into. [1] https://www.techspot.com/community/topics/critical-vulnerability-found-in-in-jpeg-processing.15412/ https://www.techspot.com/community/topics/critical-vulnerabi...

citrin_ru 6y ago
This one of main challenges in information security (and probably in IT in general) - code is completely invisible for a lay person and even for a professional it takes a lot of time to tell the difference between good and bad code. A hardware device, say a water pump made by industry leader would look very different from one made by a hobbyist in garage. It's obvious even to a lay person that a door from thick still is more break resistant than one from hardboard. But code written by a summer intern without any review and tests looks not much different from one written by seasoned professionals and carefully tested. Even if some software if full of RCE it takes a lot of time and motivation to find them. Huge amount of dependencies and many layers of abstractions make it even harder to see the software system as a whole.

by titzer 6y ago

citrin_ru 6y ago

This one of main challenges in information security (and probably in IT in general) - code is completely invisible for a lay person and even for a professional it takes a lot of time to tell the difference between good and bad code. A hardware device, say a water pump made by industry leader would look very different from one made by a hobbyist in garage. It's obvious even to a lay person that a door from thick still is more break resistant than one from hardboard. But code written by a summer intern without any review and tests looks not much different from one written by seasoned professionals and carefully tested. Even if some software if full of RCE it takes a lot of time and motivation to find them. Huge amount of dependencies and many layers of abstractions make it even harder to see the software system as a whole.