4 ms·

Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering d

Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.

akiselev 6y ago
Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
- thatguy0900 6y ago
  How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
  - akiselev 6y ago
    How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street
    - fendy3002 6y ago
      > How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited. If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.
  - bluGill 6y ago
    If I was regularly getting shot at while driving my car I'd take action. Bullet proof glass would be a must - sure it is expensive, but I'd pay that price. In fact if this was a regular thing the average car would be built more like a tank - armor, fun flat tires (or metal tracks), probably a scuba type air supply so I can't be gassed out... But since it isn't a regular thing I don't bother with that. My car wouldn't survive long in a real battle and I'm okay with that as I don't expect to have to drive my car in a real battle. The warning is out to everything network connected: it is time to invest in the equivalent of armor and bullet proof glass.
throw1122 6y ago
Things that are exposed to an adversarial environment are usually engineered with that in mind. Locks are (usually) designed to be hard to pick, for instance.
- creato 6y ago
  I think locks are about as weak as software security, relatively speaking. The difference is that if an organized gang of criminals physically broke down the doors to a corporation and stole truckloads of computers, the law enforcement response would be significant. (And we mostly wouldn't be sitting around blaming the corporation for not hiring armed guards.)
a1369209993 6y ago
Home appliances are designed not to connect to or interact with the internet. Software engineers could stand to learn a thing or two from that.

akiselev 6y ago

Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?

thatguy0900 6y ago
How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
- akiselev 6y ago
  How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street
  - fendy3002 6y ago
    > How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited. If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.
- bluGill 6y ago
  If I was regularly getting shot at while driving my car I'd take action. Bullet proof glass would be a must - sure it is expensive, but I'd pay that price. In fact if this was a regular thing the average car would be built more like a tank - armor, fun flat tires (or metal tracks), probably a scuba type air supply so I can't be gassed out... But since it isn't a regular thing I don't bother with that. My car wouldn't survive long in a real battle and I'm okay with that as I don't expect to have to drive my car in a real battle. The warning is out to everything network connected: it is time to invest in the equivalent of armor and bullet proof glass.

throw1122 6y ago

Things that are exposed to an adversarial environment are usually engineered with that in mind. Locks are (usually) designed to be hard to pick, for instance.

creato 6y ago
I think locks are about as weak as software security, relatively speaking. The difference is that if an organized gang of criminals physically broke down the doors to a corporation and stole truckloads of computers, the law enforcement response would be significant. (And we mostly wouldn't be sitting around blaming the corporation for not hiring armed guards.)

a1369209993 6y ago

Home appliances are designed not to connect to or interact with the internet. Software engineers could stand to learn a thing or two from that.