3 ms·

Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff

Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Modern security is based primarily on security through obscurity. As long as you stay up to date, all of the bugs you have are sufficiently obscure that knowledge about them is probably too expensive for the type of hacker that would target you. > Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. Why is any of that a problem? A user should not be able to threaten an organization's IT system even if they were outright hostile (unless they were put in a specific position of trust within IT; but even then the amount of damage they should be able to do from their personal work computer should be limited).

fnord77 6y ago
> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? because software is tremendously complex with a large surface area to attack. And many OS features were designed when wide-scale hacking was not a problem.
- Veserv 6y ago
  Then that means the software is hopelessly inadequate for the current environment where wide-scale hacking is a constant problem. To echo what they said, why do we accept and deploy systems that catastrophically fail in circumstances that we know are going to occur? Why is it acceptable to take systems that were not previously connected and actively make a decision to connect them to internet if they are completely unfit for that environment? And not just that, they are so unfit that they not only fail in the new environment, but they enable total organizational collapse in a way reminiscent of the exhaust port on the Death Star.
  - fnord77 6y ago
    why? because companies engineering the software cut corners to save costs, or their engineering talent isn't competent or talented enough to produce products that don't have majors vulns. You can better believe software running an aircraft carrier has been hardened 12 ways til sunday. Prosumer operating systems - not so much.
throw1122 6y ago
>Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Because there's not enough money in making things bug-free from the start. It is possible (see seL4 and They Write the Right Stuff), but the incentives aren't there. Some kind of liability or minimum standard (similar to building code) would help, but I'm not sure just how it would be best implemented.
- JasonFruit 6y ago
  That money would have to come from somewhere, though, and that's the pockets of consumers. Do they, in general, care enough? Is the security of software worth enough to them to spend the extra money? You don't just get what you pay for; you get what you're willing to pay for. And does the consumer have the expertise to evaluate the costliness of the threat or the security of the software? For that matter, I doubt the majority of developers have that expertise. You're not wrong about why it doesn't exist, but I'm not convinced the market conditions exist to rectify that.
  - Wowfunhappy 6y ago
    I for one would pay a lot just to not install updates all the time, if nothing else.
908B64B197 6y ago
> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Slightly old here means 13 years after the latest release in case of Windows XP. That's a very long time for anyone to upgrade.

fnord77 6y ago

> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? because software is tremendously complex with a large surface area to attack. And many OS features were designed when wide-scale hacking was not a problem.

Veserv 6y ago
Then that means the software is hopelessly inadequate for the current environment where wide-scale hacking is a constant problem. To echo what they said, why do we accept and deploy systems that catastrophically fail in circumstances that we know are going to occur? Why is it acceptable to take systems that were not previously connected and actively make a decision to connect them to internet if they are completely unfit for that environment? And not just that, they are so unfit that they not only fail in the new environment, but they enable total organizational collapse in a way reminiscent of the exhaust port on the Death Star.
- fnord77 6y ago
  why? because companies engineering the software cut corners to save costs, or their engineering talent isn't competent or talented enough to produce products that don't have majors vulns. You can better believe software running an aircraft carrier has been hardened 12 ways til sunday. Prosumer operating systems - not so much.

throw1122 6y ago

>Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Because there's not enough money in making things bug-free from the start. It is possible (see seL4 and They Write the Right Stuff), but the incentives aren't there. Some kind of liability or minimum standard (similar to building code) would help, but I'm not sure just how it would be best implemented.

JasonFruit 6y ago
That money would have to come from somewhere, though, and that's the pockets of consumers. Do they, in general, care enough? Is the security of software worth enough to them to spend the extra money? You don't just get what you pay for; you get what you're willing to pay for. And does the consumer have the expertise to evaluate the costliness of the threat or the security of the software? For that matter, I doubt the majority of developers have that expertise. You're not wrong about why it doesn't exist, but I'm not convinced the market conditions exist to rectify that.
- Wowfunhappy 6y ago
  I for one would pay a lot just to not install updates all the time, if nothing else.

908B64B197 6y ago

> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Slightly old here means 13 years after the latest release in case of Windows XP. That's a very long time for anyone to upgrade.