4 ms·

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly

by jokoon 6y ago

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less critical tasks, and disengaging from certain areas.

kube-system 6y ago
If you don't want it to happen, then why not become one of the people trying to prevent attacks from being successful? The best way to stop future attacks is to make current attacks unsuccessful.
- jokoon 6y ago
  It's more interesting to understand the motives of attacks. Often, attacks have a geopolitical or political motive. So the whole point of security, digital or physical, is power. For now, I really don't see the point of working in security for a single reason: there is NO REGULATION on measures of security when writing software. You can find millions of regulations for making physical products, but very few for software when it comes to security. Of course, governments have higher standards, but law should mandate that insurance companies be able to evaluate cyber risks, so there should be regulations regarding computer security.
qw3rty01 6y ago
Unlike lockpicking or actual arms races, it is possible to write software such that the only weak point is the people using it. Ideally all software would be formally verified, but that's a bit too cost/time expensive to be practical for everything, so instead computer security focuses a lot on minimizing attack surface and getting as close as possible to that "humans are the weak point" goal. Even if a 0day exists for particular software, if there's no way to reach it, then it's as good as being nonexistent.
cutemonster 6y ago
> telling people to use computers for less critical tasks, and disengaging from certain areas. I think I a bit can understand how you think. Looking at some health care related apps, I was surprised to see how buggy they were (the user interface) and silly built, wrt security. On the other hand, without computers, the alternative seems to be that the health care staff picks up the phone and just assumes you are the one you say you are
- anonymouse008 6y ago
  Which ones may I ask? I’ve been shocked to learn how many online EHR/EMRs work... it’s a bit frightening to think it would be trivial to find large densities of ailments / preconditions to exploit at a state level.
  - cutemonster 6y ago
    I'm in northern/western Europe, a not that large country, some small health care providers here. (I guess you're in the US?)

by jokoon 6y ago

kube-system 6y ago

If you don't want it to happen, then why not become one of the people trying to prevent attacks from being successful? The best way to stop future attacks is to make current attacks unsuccessful.

jokoon 6y ago
It's more interesting to understand the motives of attacks. Often, attacks have a geopolitical or political motive. So the whole point of security, digital or physical, is power. For now, I really don't see the point of working in security for a single reason: there is NO REGULATION on measures of security when writing software. You can find millions of regulations for making physical products, but very few for software when it comes to security. Of course, governments have higher standards, but law should mandate that insurance companies be able to evaluate cyber risks, so there should be regulations regarding computer security.

qw3rty01 6y ago

Unlike lockpicking or actual arms races, it is possible to write software such that the only weak point is the people using it. Ideally all software would be formally verified, but that's a bit too cost/time expensive to be practical for everything, so instead computer security focuses a lot on minimizing attack surface and getting as close as possible to that "humans are the weak point" goal. Even if a 0day exists for particular software, if there's no way to reach it, then it's as good as being nonexistent.

cutemonster 6y ago

> telling people to use computers for less critical tasks, and disengaging from certain areas. I think I a bit can understand how you think. Looking at some health care related apps, I was surprised to see how buggy they were (the user interface) and silly built, wrt security. On the other hand, without computers, the alternative seems to be that the health care staff picks up the phone and just assumes you are the one you say you are

anonymouse008 6y ago
Which ones may I ask? I’ve been shocked to learn how many online EHR/EMRs work... it’s a bit frightening to think it would be trivial to find large densities of ailments / preconditions to exploit at a state level.
- cutemonster 6y ago
  I'm in northern/western Europe, a not that large country, some small health care providers here. (I guess you're in the US?)