5 ms·
I understand the sentiment - but this may not be the case. A lot of software was written a long time ago with as-of-yet-unestablished good practices. Almost n
by jariel 6y ago
I understand the sentiment - but this may not be the case.
A lot of software was written a long time ago with as-of-yet-unestablished good practices.
Almost no concern for security or anything else.
I wonder if they actually took really good best practices both for security and just software in general, used something like Rust, used a very open dev process with a lot of eyes on it - and somehow avoided the feature creep / political feature orientation trap ... if it could not only be re-written, but made more simple.
Maybe it would take 5 years (1 design 1 develop 3 deploy and test) but it would still be worth it.
I believe that security is a much worse problem than it needs to be, because everything we depend on today was designed without much security in mind.
- justapassenger 6y agoSure, there’s tons on issues with legacy software like OpenSSL. But in almost all cases, the only way to deal with it is to slowly refactor and modernize it, not throw it away and start from scratch. Especially, if you have lots of things depending on it.
- jariel 6y agoMany of our system are existentially flawed and can't be truly fixed. Our current OSs for example, were designed in an era where security was no concern. Any app can do 'anything'. If Linux, Mac and Windows were to have been designed from the start with good containerization, no direct memory pointers (unless special case), if we were using ATM-like networking with identity etc. ... the world would be an entirely different place. It's obviously unlikely to happen, but if the powers that be actually wanted it to happen, it would. I would hope that the US military/DARPA designs a system that is hardened in a way that could be made use of in the civilian sector as well. Though it's obviously very unlikely.