3 ms·

I actually think "defense can win", unlike with real war where thanks to nuclear weapons "offense wins". C and Unix is absolute dark age crap. We know how to p

I actually think "defense can win", unlike with real war where thanks to nuclear weapons "offense wins". C and Unix is absolute dark age crap. We know how to prove programs correct. We just don't want to pay for it. There still be social engineering, etc., but that is much harder to pull off. I also think better programming techniques will eventually make programming more productive, as there is less to mentally worry about, and good libraries with lemmas exist. That means rather than being a expensive defense -- expensive offense escalation, it's a 1-time capital investment for defense vs permanent increased operational costs for offense. This is a quite unpopular opinion with security people, I'll grant, but people are also not used to thinking about technology as demand-constrained not supply constrained in general, which is exactly what's going on here and in so many other ares. A better understanding of economics and development not CS I think will be the thing that corrects this.

macinjosh 5y ago
"There still be social engineering, etc., but that is much harder to pull off." It is? In what sense? I've always understood the wisdom to be that people are one of the most leaky bits of any system.
GeneralMayhem 5y ago
>There still be social engineering, etc., but that is much harder to pull off. I think about this exactly the opposite from you, and this is why. Humans are the weakest link in most technical systems. The only secure device is one that's turned off and buried a mile deep, because if someone has to use it, they can always leak/allow someone else to use it by proxy.
foobiekr 5y ago
We actually don’t know how to prove programs correct in any kind of large scale way. And in addition, and this is from my professor who specializes in formal methods for his entire career, proving a program correct does not prove a program right.
bena 5y ago
Defense can win any single encounter, it cannot win every single encounter. Perfect defense does not exist. Especially once we get down to people. Even in your scenario, those "good libraries with lemmas" are now the point of attack. Find a weakness in that and you find a weakness in thousands of systems. And that does happen all the time. Commonly used libraries are found to have privilege escalation vulnerabilities. They get patched, then something else, somewhere else, is discovered. And sometimes the patches themselves open up other vulnerabilities. As for social engineering being more difficult to pull off, that's not true at all. We're all looking to streamline the process, we're tired, we're sleepy, we're bored, we just don't care, we hate our boss, we just want to watch the world burn. Those are all ways we fail even the most airtight security measures. Tell me the provably correct patch for willingly handing over my credentials to a malicious party.

macinjosh 5y ago

"There still be social engineering, etc., but that is much harder to pull off." It is? In what sense? I've always understood the wisdom to be that people are one of the most leaky bits of any system.

GeneralMayhem 5y ago

>There still be social engineering, etc., but that is much harder to pull off. I think about this exactly the opposite from you, and this is why. Humans are the weakest link in most technical systems. The only secure device is one that's turned off and buried a mile deep, because if someone has to use it, they can always leak/allow someone else to use it by proxy.

foobiekr 5y ago

We actually don’t know how to prove programs correct in any kind of large scale way. And in addition, and this is from my professor who specializes in formal methods for his entire career, proving a program correct does not prove a program right.

bena 5y ago

Defense can win any single encounter, it cannot win every single encounter. Perfect defense does not exist. Especially once we get down to people. Even in your scenario, those "good libraries with lemmas" are now the point of attack. Find a weakness in that and you find a weakness in thousands of systems. And that does happen all the time. Commonly used libraries are found to have privilege escalation vulnerabilities. They get patched, then something else, somewhere else, is discovered. And sometimes the patches themselves open up other vulnerabilities. As for social engineering being more difficult to pull off, that's not true at all. We're all looking to streamline the process, we're tired, we're sleepy, we're bored, we just don't care, we hate our boss, we just want to watch the world burn. Those are all ways we fail even the most airtight security measures. Tell me the provably correct patch for willingly handing over my credentials to a malicious party.