3 ms·
The parent comment was written early into my reaction to the news and I think I was a bit histrionic in my commentary about the security industry. People are h
by jka 6y ago
The parent comment was written early into my reaction to the news and I think I was a bit histrionic in my commentary about the security industry. People are helping, and that's commendable.
It can be difficult when it appears that we are building and deploying so much more software than we are maintaining and securing.
I don't know exactly what mindset will win out - either an assumption that information always leaks and that that's helpful to catch people when they might fall, and/or a mindset that believes it's necessary to be able to create private channels -- if perhaps not private spaces, for safety reasons (is there a digital distinction there? could there be?). Fragmentation and/or consensus are two possible paths forwards (that different communities are already exploring).
- UweSchmidt 6y agoMaybe you weren't histrionic enough? I couldn't name one class of software or hardware, nor one layer in the 'stack' that hasn't been compromised. The only conclusion is to admit failure (as an industry) and rebuild everything from the ground up.
- ta988 6y agoWe always have to do compromises designing these things. Either we don't have the talents, we disagree on the methods, we ignored a chunk of the problem, we don't have the ressources, we deliberately degrade to please the senders of a letter-we-cant-talk-about... I prefer the approach where we solve problems incrementaly as we discover them because in the long term it addresses all of those shortcomings eventually.
- skynet-9000 6y agoI agree. There will always be an attacker who knows more or who used methods that you would not choose. It's inevitable that some things will leak. Defense in depth will help mitigate the risk and contain the fallout. (extreme paranoia, perhaps bred of experience, doesn't hurt either!)
- qyi 6y agoNo, you were correct. Some people are helping here and there but overall every aspect of the software industry is an absolute mess. Most infosec pros will not point this out, either because they are tunnel visioned on their niche, are trying to sound politically correct, or just trying to not start shit (but nothing will be solved ever if people keep pretending everything's all and well).