5 ms·

"If you don't have a problem, there is no need to fix it" You really need to think a bit deeper about this. You obviously don't have much experience with secur

"If you don't have a problem, there is no need to fix it" You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here. First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No one is going to change your desktop wallpaper to say "You have been hacked", like in the movies... Which leads me to the second point. What valuables does your organization have? Do you have recipes for a special kind of glue that your researchers spent a few million dollars inventing? Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? And what about the customers that buy your product? Do they care if all your communication with them, and any issues concerning this product that should only be known internally is widespread?

emilfihlman 6y ago
>You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here No it's you who is making assumptions and operating on "it must be this way" sense. Simply because a project has not had changes in a few years (or even many years) doesn't make the project insecure or bad. Can there be bugs or security issues? Or course, any software can have those, but merely change rate as you see on the project download page has no bearing on that.
majkinetor 6y ago
> You obviously don't have much experience with security and you make a lot of assumptions here. You obviously work in security and want to sell me bs. > First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No, you assume a lot about me while knowing 0. The bigger problem here is that you assume that people in corp care that there are hidden agents taking some data out. Let me open your eyes: they usually don't and ESPECIALLY if its not visible. If you replace their main site front page they will care. > What valuables does your organization have? Dude... go read my post again. > Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company. WHEN they care, I do it. Mine is to inform. Theirs to decide. Guess what: they always decide against it, naturally, as it costs more otherwise. Security is a feature. It costs money. It can be theoretically done forever and take infinite amount of money. In last decade I had just 1 stakeholder requesting "unbreakable system" and we did the best we could. Your main mistake seems to be to extrapolate your context to entire world. Context is everything.
- gypsyharlot 6y ago
  "> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company." Enough said.
  - majkinetor 6y ago
    The other name for what I tell is professionalism. The other name for what you tell is racketeering. What part of "educating stakeholder and let them decide" you didn't understand ?
    - gypsyharlot 6y ago
      "majority of tools don't need any updates if they already work as designed" This is just about the dumbest thing I've read on HN. It's fascinating that you think of yourself as professional. Like I said, most organizations have no clue what's actually happening in their networks - mostly due to people like you. Have fun when the digital forensics team is dispatched to one of your sites that has had all its data lost to some crypto virus (because when that happens, they notice). And the forensics guys will write a report which outlines the reason why it happened. And the reason is nearly always outdated software.
      - jcelerier 6y ago
        > Like I said, most organizations have no clue what's actually happening in their networks you act like most software is on the network. But a majority of the software I use either for my work or for my leasure time don't even open a socket.
        Mediterraneo10 6y ago
        Lots more software today is on the network than many people think. Even if network access is not required for an application’s functionality, the software may still do an update check to a remote server so that it can alert users to a new update available.
wccrawford 6y ago
I'm really surprised to see you're being downvoted for this statement. You don't even need to have anything valuable in your company for security to matter because your customers' personal data is valuable to them, and by law you have to protect it in many places now. A security breach must be publicized, and that's a black mark on your company whenever anyone is considering using it in the future. It doesn't even really matter how big that breach is, or what data was stolen. But even worse, an unethical competitor might hack your data and erase it, leading to lengthy downtime or even permanently lost data. That's most a server-side focus on security, but even client-side there could be things that allow hackers to mislead or damage your customers. Libraries are updated constantly as old vulnerabilities are discovered and new methods of attack are invented. Leaving your OS or libraries un-updated is virtually guaranteeing that you end up vulnerable somehow. The idea that if you don't know about a security problem, you don't need to fix it... Wow, it's just mind-boggling to me.
- majkinetor 6y ago
  World is a messy place, its far away from what they learn you at academia. Welcome.
  - wccrawford 6y ago
    Attacks like that are not really acceptable on this site.
- Silhouette 6y ago
  I suspect the difference of opinion is because those two people are making very different assumptions. One comes across as too dismissive of security concerns, suggesting security is not their problem unless management is bothered. The other comes across as assuming most software is used in ways where security problems are a major risk. Neither is realistic. Combine that with an unnecessarily hostile tone and some ad hominem, and it's going to attract downvotes on a forum like HN where civil discussion and logical arguments are both usually appreciated.

emilfihlman 6y ago

>You really need to think a bit deeper about this. You obviously don't have much experience with security and you make a lot of assumptions here No it's you who is making assumptions and operating on "it must be this way" sense. Simply because a project has not had changes in a few years (or even many years) doesn't make the project insecure or bad. Can there be bugs or security issues? Or course, any software can have those, but merely change rate as you see on the project download page has no bearing on that.

majkinetor 6y ago

> You obviously don't have much experience with security and you make a lot of assumptions here. You obviously work in security and want to sell me bs. > First of all, you seem to make the assumption that when an organization gets compromised, they will know about it. No, you assume a lot about me while knowing 0. The bigger problem here is that you assume that people in corp care that there are hidden agents taking some data out. Let me open your eyes: they usually don't and ESPECIALLY if its not visible. If you replace their main site front page they will care. > What valuables does your organization have? Dude... go read my post again. > Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company. WHEN they care, I do it. Mine is to inform. Theirs to decide. Guess what: they always decide against it, naturally, as it costs more otherwise. Security is a feature. It costs money. It can be theoretically done forever and take infinite amount of money. In last decade I had just 1 stakeholder requesting "unbreakable system" and we did the best we could. Your main mistake seems to be to extrapolate your context to entire world. Context is everything.

gypsyharlot 6y ago
"> Would you want a bunch of foreign companies sitting in your network, siphoning all your hard work out for free? I don't care. Its up to my stakeholders, I don't work for my granpas company." Enough said.
- majkinetor 6y ago
  The other name for what I tell is professionalism. The other name for what you tell is racketeering. What part of "educating stakeholder and let them decide" you didn't understand ?
  - gypsyharlot 6y ago
    "majority of tools don't need any updates if they already work as designed" This is just about the dumbest thing I've read on HN. It's fascinating that you think of yourself as professional. Like I said, most organizations have no clue what's actually happening in their networks - mostly due to people like you. Have fun when the digital forensics team is dispatched to one of your sites that has had all its data lost to some crypto virus (because when that happens, they notice). And the forensics guys will write a report which outlines the reason why it happened. And the reason is nearly always outdated software.
    - jcelerier 6y ago
      > Like I said, most organizations have no clue what's actually happening in their networks you act like most software is on the network. But a majority of the software I use either for my work or for my leasure time don't even open a socket.
      - Mediterraneo10 6y ago
        Lots more software today is on the network than many people think. Even if network access is not required for an application’s functionality, the software may still do an update check to a remote server so that it can alert users to a new update available.

wccrawford 6y ago

I'm really surprised to see you're being downvoted for this statement. You don't even need to have anything valuable in your company for security to matter because your customers' personal data is valuable to them, and by law you have to protect it in many places now. A security breach must be publicized, and that's a black mark on your company whenever anyone is considering using it in the future. It doesn't even really matter how big that breach is, or what data was stolen. But even worse, an unethical competitor might hack your data and erase it, leading to lengthy downtime or even permanently lost data. That's most a server-side focus on security, but even client-side there could be things that allow hackers to mislead or damage your customers. Libraries are updated constantly as old vulnerabilities are discovered and new methods of attack are invented. Leaving your OS or libraries un-updated is virtually guaranteeing that you end up vulnerable somehow. The idea that if you don't know about a security problem, you don't need to fix it... Wow, it's just mind-boggling to me.

majkinetor 6y ago
World is a messy place, its far away from what they learn you at academia. Welcome.
- wccrawford 6y ago
  Attacks like that are not really acceptable on this site.
Silhouette 6y ago
I suspect the difference of opinion is because those two people are making very different assumptions. One comes across as too dismissive of security concerns, suggesting security is not their problem unless management is bothered. The other comes across as assuming most software is used in ways where security problems are a major risk. Neither is realistic. Combine that with an unnecessarily hostile tone and some ad hominem, and it's going to attract downvotes on a forum like HN where civil discussion and logical arguments are both usually appreciated.