2 ms·

Roof/building/bridge construction are things that have been around thousands of years. And they still get things extremely wrong sometimes: look up the footbrid

Roof/building/bridge construction are things that have been around thousands of years. And they still get things extremely wrong sometimes: look up the footbridge in London as an example, it needed the equivalent of a security patch. On the issue of roofs, it's also often recommended that you do annual roof inspections and maintenance, looking for potential issues. Regardless, we're talking about security, so let's go to the actual real-world equivalent. Physical security. Is perfection possible there? Nope. Anything even remotely capable of surviving a sustained attack is going to cost an amount of money reserved for corporations and nations, not everyday consumers. If you think the current quality of physical engineering is something we should hold up as a comparison to the security quality expected of software, let's compare notes in a few hundred years when programming reaches the same level of maturity.

labawi 5y ago
> thousands of years Maybe I should have used electrical installations as an example? > real-world equivalent. Physical security Physical security isn't a good analogue, because you don't have a line of hackers, trying to get into your cupboard and magically also millions of other cupboards, closets and storage rooms with near 0 marginal cost and incomparably easy way to avoid getting caught. Unlike physical security, perfect SW security is pretty much attainable (shocking, isn't it), with 0 marginal cost (no cost to duplicate). Physical access, social manipulation etc is physical security. > footbridge in London One bridge in 100, caught before it failed? Compared to all SW with network access and weekly updates. We know how to engineer things so they are reasonably safe, we actually do it. We also know many ways to make software much, much safer with only moderate investment, and some ways to make provably correct SW, and we do not care.

labawi 5y ago

> thousands of years Maybe I should have used electrical installations as an example? > real-world equivalent. Physical security Physical security isn't a good analogue, because you don't have a line of hackers, trying to get into your cupboard and magically also millions of other cupboards, closets and storage rooms with near 0 marginal cost and incomparably easy way to avoid getting caught. Unlike physical security, perfect SW security is pretty much attainable (shocking, isn't it), with 0 marginal cost (no cost to duplicate). Physical access, social manipulation etc is physical security. > footbridge in London One bridge in 100, caught before it failed? Compared to all SW with network access and weekly updates. We know how to engineer things so they are reasonably safe, we actually do it. We also know many ways to make software much, much safer with only moderate investment, and some ways to make provably correct SW, and we do not care.