4 ms·

Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Is t

Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Is that the problem you'd hope to solve? That it all happened within a few days instead of at different institutions at different times?

brundolf 6y ago
Yes, distributing the same number of hacks over a period of time would on its own make things a little bit less fragile. In general, having a single point of failure is bad for the stability of any large system. But more likely: imagine all these orgs were distributed across three or four providers. A bad actor comes up with a zero-day for one of them. They can now a) go ahead and use that, far fewer systems are compromised and awareness of the threat is raised, or b) wait a much longer time until they come up with vulns for all the other systems. Either of those is less bad than the current situation. These days it's starting to feel like China might get to a point where they could shut down an entire country, all at once, with the flip of a switch.
- exporectomy 6y ago
  One hack happening doesn't raise awareness for the risk of different unknown vulnerabilities in different software. So the total number of institutions getting hacked would be the same. It's not really one system. It just looks like that because it's one news story. If instead, all school districts were hacked this year and all police departments next year, how is that any better than both together? If it was one system like one network, your idea is even worse because having more different software increases the attack surface so hacking any one of those compromises the whole system. Would you personally use uncommon software to avoid being part of a big hack like this? I don't think that's a valid way of protecting yourself. Your idea would make sense if many of these institutions were just providing services that were redundant with each other. Then if some of them are disabled, the others can take their place. But a police department's email server can't do the job of a school district's one. And if confidential information is taken in a hack, redundancy doesn't help at all.
- ISL 6y ago
  The opening volleys of major future conflicts might be coincident with each country shutting down the other's computers.
- rcoveson 6y ago
  Right. Software diversity (as long as it's real, all-the-way-down diversity and not just different branding of the same tech) is beneficial to overall security for more or less the same reasons that gene pool diversity is beneficial to the survival of a species. This is one instance where our choice of metaphorical vocabulary, like "virus", is very apt. Only one vendor for all corporate email is bad for the same reason that only one popular variety of banana is bad.
tablespoon 6y ago
> Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Yes, but you're describing a more resilient system. A monoculture can get totally knocked out by one vulnerability.

brundolf 6y ago

Yes, distributing the same number of hacks over a period of time would on its own make things a little bit less fragile. In general, having a single point of failure is bad for the stability of any large system. But more likely: imagine all these orgs were distributed across three or four providers. A bad actor comes up with a zero-day for one of them. They can now a) go ahead and use that, far fewer systems are compromised and awareness of the threat is raised, or b) wait a much longer time until they come up with vulns for all the other systems. Either of those is less bad than the current situation. These days it's starting to feel like China might get to a point where they could shut down an entire country, all at once, with the flip of a switch.

exporectomy 6y ago
One hack happening doesn't raise awareness for the risk of different unknown vulnerabilities in different software. So the total number of institutions getting hacked would be the same. It's not really one system. It just looks like that because it's one news story. If instead, all school districts were hacked this year and all police departments next year, how is that any better than both together? If it was one system like one network, your idea is even worse because having more different software increases the attack surface so hacking any one of those compromises the whole system. Would you personally use uncommon software to avoid being part of a big hack like this? I don't think that's a valid way of protecting yourself. Your idea would make sense if many of these institutions were just providing services that were redundant with each other. Then if some of them are disabled, the others can take their place. But a police department's email server can't do the job of a school district's one. And if confidential information is taken in a hack, redundancy doesn't help at all.
ISL 6y ago
The opening volleys of major future conflicts might be coincident with each country shutting down the other's computers.
rcoveson 6y ago
Right. Software diversity (as long as it's real, all-the-way-down diversity and not just different branding of the same tech) is beneficial to overall security for more or less the same reasons that gene pool diversity is beneficial to the survival of a species. This is one instance where our choice of metaphorical vocabulary, like "virus", is very apt. Only one vendor for all corporate email is bad for the same reason that only one popular variety of banana is bad.

tablespoon 6y ago

> Really? Wouldn't multiple softwares be equally vulnerable overall but the hacks would be more distributed in time as they're discovered at different times? Yes, but you're describing a more resilient system. A monoculture can get totally knocked out by one vulnerability.