60 ms·

The Insecurity Industry

743 points by stanislavb 5y ago

ngneer 5y ago
Loved seeing language safety features called out. How can we prevent monoculture yet retain interoperability and profitability? Are these inherently at odds?
- mikewarot 5y ago
  Diversity can help improve interoperability, if everyone sticks to only the public APIs and protocols, you can cross-run unit tests and make sure that everyone passes all of the unit tests for all implementations, and yield the same results, the only difference should be in performance. Like farming, monocultures seem profitable, until the pests show up, and can swamp out all of the advantages.
keeganjw 5y ago
TIL Edward Snowden has a substack.
deleted 5y ago
[deleted]
bambax 5y ago
> it is still hard for many people to accept that something that feels good may not in fact be good This strikes me as surprising. I have always been taught the opposite: if it feels good, it's probably bad for you, or illegal, or immoral, or all three.
- ASalazarMX 5y ago
  I'd take out the immoral, as it feels puritan. Also, there are nice things that are good, legal and moral, like stretching after a good night sleep, a professional massage, ad blocking, etc. Maybe I'm being too literal here.
  - dylan604 5y ago
    Yeah, I'm sure there are some that would think ad blocking as immoral as you're "trying o get something for free" blah blah As puritan as it feels, a large part of the population likes it that way and want it even more strict.
  - npteljes 5y ago
    I love it that you included ad blocking as moral. Absolutely agreed.
- koolba 5y ago
  > if it feels good, it's probably bad for you, or illegal, or immoral, or all three. Pretty much. The only exceptions I’ve found are exercising and saunas.
  - hashkb 5y ago
    Creating art can feel pretty good. Most art is legal these days.
- tomc1985 5y ago
  Protestant Western propaganda at its finest
- low_tech_love 5y ago
  Interesting, when I read that line I thought the exact opposite. It sounds exactly line how I feel about the people around me.
deleted 5y ago
[deleted]
o8r3oFTZPE 5y ago
[accidental dupe. see above comment]
- tootie 5y ago
  Who dismisses it? I think it's a pretty good idea. I think an enforceable law would have be more thoughtful than just paying for every breach. We need a reasonable standard for responsible security and how to assign blame.
- michaellee8 5y ago
  I bet aoftware that is so secure to be compared to products of other engineering fields does exist (e.g. avionic systems), but you will have to pay a much higher cost to use it, luke hundreds of thousands dollars since the cost of acheieved the guaranteed security level would also be much higher. Given the low cost of modern consumer software, you really have to understand that you get what you paid for. And if you want security guarantees you don't just need that particular piece of software being secure, you need qualified people to operate it, the hardware running it being secure (probably propietry and cost hundreds of thousands), and the whole software stack being secure as well, from firmware to OS to networking code. This is simply not somehow that your general consumer can afford, and if you enforce that level of security in consumer software like smartphones, it is safe to bet that almost everyone that has a smartphone would be protesting since they would have no Software aviliable on there phone anymore. Like one comment above said, there do exist ways to enforce that level of software security, (like railway traffic lights) but the cost would be ridiculously high, and those systems are probably not running any consumer kind of software stack, probably without an OS since Linux would has it own vulnerability as well. Those systems are probably made for custom hardware that the software vendor has total control of it as well.
mikewarot 5y ago
I was all ready to post a reply... when I was hit by the darkest pattern of all... you must pay to do so, with no hint prior to that moment.
- dcow 5y ago
  Substack replies are paid? Hmm. Thinking about this right now: annoying sure but why do you consider this pattern dark? I bet it reduces spam and trolling by orders of magnitude unlike say confusing cookie dialogs designed to make you surrender all your private info.
  - DantesKite 5y ago
    Seems like it would lead to marginally better discussions too. Or at least, very very heated ones.
  - ManuelKiessling 5y ago
    The dark pattern is that you don’t know it beforehand, not the paywall itself.
    - littlestymaar 5y ago
      You know before typing your comment though. The real dark pattern would be if it had let you type and then ask for money to submit your comment.
      - arc-in-space 5y ago
        You do have to start typing before it informs you, which means you already had a reply in mind. I agree that's pretty bad.
o8r3oFTZPE 5y ago
"For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product." That sort of discussion is quickly dismissed on HN. And probably elsewhere on the web/over the internet. Instead we frequently see discussion blaming users of the software, i.e., Microsoft's customers, or even suggestions to make the customer liable, or comments from "security experts" on how Microsoft has made such amazing strides in securing Windows (a tangent). In the real world, outside the Redmond/Silicon Valley monopoly space, how many mistakes does someone have to make before we start to suspect there might be problems with relying on that person's work. Even more, how many times do we hire someone knowing they have made 500+ mistakes in prior work leading up to their application. If Microsoft products are so infallible when used as instructed by Microsoft, then why would Microsoft have a heart attack as Snowden suggests. What a remarkable state of affairs we have today where employers such as Microsoft can call their employees "engineers", and yet both the employer and employees are absconded from any liability for the so-called engineer's work. The number of "second chances" Microsoft gets is nothing short of astounding. A bit like the number of pardons we allow to Google or Facebook for privacy infractions. Infinite. https://www.nspe.org/resources/professional-liability/liability-employed-engineers https://www.nspe.org/resources/professional-liability/liabil...
- ChrisMarshallNY 5y ago
  Regardless of all that, I would love to see a big improvement in basic software Quality. Easy to say; not so easy to do. It is actually difficult to answer the [seemingly] simple question “What, exactly, is ‘Quality’?”. I think I do a fairly good job, there, on my own work, but what works for me, won’t work for most.
- maliker 5y ago
  My guess is the ‘users didnt know what they were doing defense.’ Not that you can deploy software in a secure by default stance. But once somebody sets up users and a million other settings inside Active Directory, it’s pretty much bound to be insecure. And then the defense is akin to ‘you werent supposed to crash the car into the tree’.
fungiblecog 5y ago
Nothing will change
- rvz 5y ago
  They will never change. It's only going to get worse as the world enjoys their new remotely controlled telecommunications devices.
- swiley 5y ago
  Maybe we'll get open source drivers and have the PostMarketOS devs handle it.
  - npteljes 5y ago
    I think this is the most we can strive for: a sustainable niche alternative.
- meowface 5y ago
  Eh, I think it's plausible that in 20 years almost all critical code will be written in memory-safe languages and that this particular bug class will essentially be eliminated for new software. There'll always still be RCE bugs of some kind, but it's probably going to get harder and harder to find them, exploit them, and escape sandboxes and mitigations.
2OEH8eoCRo0 5y ago
Edward Snowden is a traitor or a coward. Daniel Ellsberg gave the pentagon papers to the press after trying to give them to Congress. He then fought the govt in court and won. Ellsberg is a patriot.
- lu4p 5y ago
  No he's not, he even stated, that he is fine with coming back to the US if he is guaranteed a fair trail. https://www.washingtonpost.com/news/the-switch/wp/2015/10/06/edward-snowden-says-he-would-go-to-jail-to-come-back-to-the-u-s/ https://www.washingtonpost.com/news/the-switch/wp/2015/10/06...
  - throwmeawayya 5y ago
    Did the US government explicitly deny him a fair trail?
    - sydthrowaway 5y ago
      Look at the dirty tricks they employed with Assange. Snowden’s paranoia has been vindicated.
      - fortuna86 5y ago
        Assange is in prison in England.
      - pstch 5y ago
        It's not even paranoia. He wants to present reasons of his actions, and the judicial authorities won't allow that, and are not even really hiding it.
    - fortuna86 5y ago
      Did the FBI deny D.B. Cooper a fair trial?
  - 2OEH8eoCRo0 5y ago
_wldu 5y ago
Nice to see that he linked to rust as a safe alternative to the C's (C, C++, Objective-C). There is a place for Go and Java as well above the system level. Both perform well and are safe.
- zozbot234 5y ago
  Go is not safe for concurrent code, unfortunately. Specifically, it does not protect against data races on non-atomic types, which can lead to torn writes and break invariants that are required for safety.
  - lu4p 5y ago
    True, but still memory safe, also Go has a race detector included which is really easy to use https://blog.golang.org/race-detector https://blog.golang.org/race-detector
    - roca 5y ago
      No, Go is not memory safe for concurrent code. Race detection is good but can't eliminate races altogether.
      - pjmlp 5y ago
        Same applies to Rust as well actually. Its type system only prevents data races for in-memory data structures, on the same OS process. There are plenty of other concurrency races.
        roca 5y ago
        It's true that there are "higher level" races that Rust can't prevent. But in-memory races are particularly important to prevent, because a) they're a common and very nasty kind of bug and b) it means unlike Go, Rust (the safe subset) is memory safe (and in general, free of undefined behaviour) for concurrent code.
  - 5y ago
spoonjim 5y ago
I thought this was going to be about Instagram making money by making people, especially women, feel worse about themselves. Turns out there are multiple insecurity industries operating today...
3pt14159 5y ago
I'm not going to comment on Snowden's view of what liberal western states do when it comes to surveillance. I have my own opinion, but he's been right about stuff I'd disagreed with him in the past before so I'm gun shy about confronting his ideas again. On the topic of unsafe language though, he's absolutely right. We don't have to put up with this. We could pass a law and ban new code in unsafe languages from national security threatening devices like phones or cyberphysical devices like self-driving cars and we would be the better for it in under a decade. We could even have taxes to give breathing room during a transitionary period to encourage it before outright banning it, but we don't. We don't because so often it is less of a hassle for the government to trust the private sector that it is to take some real position on the regulatory issues that matter. This will probably always be the case until the government is able to evaluate talent and pay salaries in accordance with that talent as the private sector is.
- SV_BubbleTime 5y ago
  If there is one thing politicians are surely better at it than programmers is making decisions about what programming languages should be used! /s Yes on theme, but no on ”there aught to be a law” that bans C/C++ because of an evolving goal of memory safety. When Rust++ comes out surely there will be people complaining that Rust isn’t safe, and so on. Best case is you make the consequence punishable (as was described in the article).
  - mikepurvis 5y ago
    Other industries handle this kind of thing with a layer of indirection: instead of laws from the state, the state imbues a professional body with certification power, and the body sets standards by consensus or whatever other process among their members. So if you're an architect, or lawyer, or tradesperson, or whatever, you have to do things in the manner prescribed or you lose your license. I know this kind of thing is a lightening rod for a lot of software folks, but it does have the nice property that it's proactive; you don't have to wait around for the obviously-unsafe practice to blow up in someone's face before you can do something about it. And no one wants to have to get licensed to write some crud app in NodeJS. But maybe these kinds of high-stakes modules related to encryption, security, and so on could be a place to start with it; if you're going to work in these areas, and offer your work to the public (for money or otherwise), then you either need to be licensed by the professional body, or clearly advertise in the header of each file that the work has not be overseen by a licensed professional. That's the kind of arrangement that could do things like specify languages, methods, interfaces, and so on.
lifeisstillgood 5y ago
I tend to bang on about software not as engineering but as literacy. It makes some sense even here - that bad code is as common as bad law - and often for the same reasons, politics, money, and hard questions "Engineering" is a wide subject - the big stuff is carefully built and highly regulated - bridges and buildings. But as we go down the scale we see engineering give way to the problems of politics and money - tower blocks collapse for example, and then we see human level engineering - factory tools that try to meet inflicting goals, dangerous toys and so much more. The software world should not beat itself up for not being like all those engineers - when lives are not on the line engineers get tied up just the same as the rest. And when lives are on the line, software and hardware engineering have learnt a few things - reduce the scope to the barest possible essentials - have a lot of redundancy and stick to well known designs.
- jonas21 5y ago
  Also, traditional engineers design things to withstand conditions that they would reasonably face in ordinary use, with some additional safety factor. They don't design them to withstand deliberate attacks by nation-level actors like we're seeing here. If a car explodes because it got hit by an artillery shell, would anyone hold the automotive engineers responsible? If a building collapses because a bomb was dropped on it, would anyone hold the civil engineers responsible?
  - andyferris 5y ago
    This is an interesting point. I think the difference here is that no car could be engineered to withstand an artillery shell, whereas we can imagine an iPhone not susceptable to this particular vulnerability (it already exists). Perhaps one argument is that the space of _potential_ vulnerabilities in something as complex as an iPhone is so huge that it just isn't feasible to create one that can withstand all network-based attacks (in which the attacker hasn't obtained user consent, Apple's signing keys, etc)? However I'm not sure if I buy that argument, or not...
  - dylan604 5y ago
    That depends really. In the US, nuclear power plants are supposed to be able to withstand a certain amount of damage, specifically a direct impact of a certain sized plane (even before 9/11). So, like all things, it's a bit of a matter of perspective.
siliconc0w 5y ago
I don't think you'd have to ban unsafe languages but you could pass a law that slowly decreased the amount of money the government could spend on 'unsafe' software (either through direct licensing or renting through clouds). The government is such a huge client to these companies that it'd immediately create a large financial incentive to migrate.
- staticassertion 5y ago
  I think this is probably one of the better, more practical ideas that I've seen. If the government has to consider whether the underlying technology has adequately addressed memory safety issues (doesn't have to be at a language level, but that's obviously the easiest way), that puts pressure on them to fund projects that use memory safe approaches. That's billions of dollars that will get slowly steered in the right direction.
  - BruiseLee 5y ago
    And naturally the ones to decide which software is unsafe will be the lobbyists from the most powerful tech companies like Microsoft or Google.
    - staticassertion 5y ago
      Not really, no.
deleted 5y ago
[deleted]
rognjen 5y ago
While his message is undoubtedly important I find his writing style is overly condescending and detracts from the message.
- ramraj07 5y ago
  He probably has earned the right to be condescending as much as say Linus has. Dude risked it all to expose what he thought was wrong, and only someone as smart as him could have managed to stay alive and out of jail (albeit barely) facing off the most powerful country in the world.
  - rognjen 5y ago
    Messages from public advocates should be delivered with more tact and understanding if you're serious about influencing public opinion. For instance, if you like the Washington Post, and read this article you'll be quite annoyed at the "have to lose your spine" remark. The message is then diluted. If you're just a regular consumer who likes the iPhone you'd be annoyed at the latte status symbol quip. The message is then diluted. I don't think comparison with Linus is equivalent because he doesn't publicly advocate much whereas that's mainly what Snowden does. (Perhaps I should have included this in the original comment.)
  - cf499 5y ago
    "He probably has earned the right to be condescending as much as say Linus has." It's not about rights, it's about desires and personal insecurities. People who derive pleasure from condescension are just telling you that they're vulnerable to manipulation via flattery. It's bad opsec! :P
- larsiusprime 5y ago
  C'mon. Compared to what I'm used to from the median big shot internet blogger or NYTimes op-ed page, Snowden is positively pulling his punches here.
AlexCoventry 5y ago
> iOS's update model is 1000% better than Android's, which is a massive security improvement against most threat actors (who aren't using artisanal Israeli zero-day exploits). What are the advantages of iOS's update model?
- edrxty 5y ago
  Software updates actually occur for old hardware. Android almost never gets updates for anything older than a couple years. I hate iOS for it's walled garden bullshit but android seems to have found the one way to be worse.
wly_cdgr 5y ago
I doubt "real" engineering is better. It's just that attacking its artifacts doesn't scale, so it looks more secure. In fact, the average bridge or skyscraper is probably absolutely riddled with serious design and manufacturing flaws
- imwillofficial 5y ago
  The design process is pretty rigorous. Anything to back up your idea?
  - jchook 5y ago
    Not necessarily agreeing but reminded of the Harvard Bridge in Boston. I heard that though it was often called the MIT bridge (because it connects MIT campus to Boston), they felt fine with the name “Harvard” after learning it was structurally unsound. https://en.wikipedia.org/wiki/Harvard_Bridge https://en.wikipedia.org/wiki/Harvard_Bridge
    - wly_cdgr 5y ago
      Smoots would have been ashamed, smh....
  - wly_cdgr 5y ago
    Challenger, Columbia (safety culture at NASA really improved after Challenger huh), Chernobyl, Three Mile Island, Fukushima, recent FL condo collapse, my average five story Brooklyn apartment building's basement and roof after a thunderstorm, Boeing's long and growing list of recent fuckups... is some stuff that comes to mind off the top of my head. Makes you wonder how many close calls, less major incidents, cracks that are noticed and repaired in time, buildings that happen to be demolished twenty years before collapsing to make way for redevelopment, etc we don't even hear about, no? What about you - anything to back up your claim?
    - deleted 5y ago
      [deleted]
high_byte 5y ago
>basically turns the phone in your pocket into an all-powerful tracking device that can be turned on or off, remotely, unbeknownst to you, the pocket’s owner even more so with Android & iOS.
- KirillPanov 5y ago
  Targeting those is for n00bs. Backdooring the modem firmware is far more useful, and reliable. Not to mention undetectable -- not only is the user unable to recompile or replace this firmware, they can't even get a checksum of it. Qualcomm's modem chips get their own private NAND flash that they can use as they please.
  - dylan604 5y ago
    Thanks for that. I'll sleep well now. These are the litteral nightmare scenarios.
  - quenix 5y ago
    Realistically, how useful is compromising modem firmware if like 98% of communication done through it is encrypted at the AP level? It’s sorta like wiretapping a fiber optic cable—okay, what now?
    - KirillPanov 5y ago
      On SoCs with an on-chip modem, the modem can write to any part of host memory it likes. No IOMMU. On the (very) few remaining phones that use two separate chips, what do you think the odds are that the host OS is hardened against attacks originating from its own modem? That is a hideously complicated protocol spoken between the modem and the host processor. Plenty of validation+overflow footguns. Finding exploits here isn't going to get security researchers promoted, if they can find them at all. "Exploit is available only to modem manufacturer" does not engender a high CVE score. Oh, and, just to top it off, that interface between the modem and the host processor when they aren't on the same chip is... drum roll... USB. As in, BadUSB. As in, Mr. Phone says: "wow, somebody plugged in a USB keyboard! And a USB mouse!". But hey, the modem doesn't even need to own the CPU. It can record and exfiltrate your GPS location quite happily via LTE, all on its own. And buffer up a nearly unlimited amount of location data on that private NAND flash it has in case you're out of cell range. All while pinky-swearing that location services are definitely absolutely turned off, promise. I don't know why people believe that location-tracking is ever turned off on a phone; it's just absurd to think that.
nxpnsv 5y ago
Off topic: I counted no less than five different subscribe buttons. Is that the point of diminishing returns?
pyuser583 5y ago
Is Python a safe language? It doesn’t seem to have the sorts of problems other languages do. Why is that?
- franga2000 5y ago
  Most interpreted languages are "safer" in this regard as they don't leave the memory management up to their users. The interpreter itself could still have such bugs, but that's a comparably much smaller attack surface and has far more eyes on it that any random person's code, so these are less frequent. And it's not just fully interpreted languages - any language that manages memory for your and doesn't let you mess with it yourself (like Java, C#...) will be safer, assuming the compiler and runtime are secure.
- aix1 5y ago
  There are at least two things that could be contributing to this perception: 1. Python is (usually) an interpreted language, and it's probably true to say that interpreted languages tend to have a lower attack surface (at the cost of lowered performance). 2. While Python is very popular in certain domains (numerical computing, ML etc), there are few low-level systems that are written in Python.
- 7373737373 5y ago
  Absolutely not, unfortunately. One of the architectural issues plaguing even comparatively memory-safe languages is the fact that there is a global scope that's accessible from anywhere. In some Python versions even numbers or truth values could be redefined. [0] This makes it impossible to sandbox functions or imported modules, because they can communicate arbitrarily. But communication/access security is not the only problem. Resource security is something I haven't seen any significant language (besides Java perhaps) try to approach - being able to limit the memory and cpu usage of a (part of a) program. Modern languages should make it possible to do both with just a few lines of code. I recommend reading about Capability Security[1], the E language[2] and the Principle of least Authority (POLA) [3] [0] https://hforsten.com/redefining-the-number-2-in-python.html https://hforsten.com/redefining-the-number-2-in-python.html [1] http://www.cap-lore.com/CapTheory/ http://www.cap-lore.com/CapTheory/ https://en.m.wikipedia.org/wiki/Capability-based_security https://en.m.wikipedia.org/wiki/Capability-based_security [2] http://www.erights.org/ http://www.erights.org/ [3] https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... These originated in the mainframe era, in a connected world before the internet, at the inception of the first multi-user systems: https://github.com/void4/notes/issues/41 https://github.com/void4/notes/issues/41
DoingIsLearning 5y ago
It feels like we've gone full circle back to 1980 when the US Defense comissioned a 'safe' embedded language. Jean Ichbiah's team won this contract with the language 'Green' in 1979. They subsequently went on to further develop this and standardize it in what was then the Ada 83 language standard. The more I think about the more it feels that Ada just came about to solve the right problem but at the wrong time.
- pjmlp 5y ago
  Unisys still sells Burroughs to customers that care about top level security. https://en.wikipedia.org/wiki/Burroughs_large_systems https://en.wikipedia.org/wiki/Burroughs_large_systems ESPOL/NEWP were the very first system programming languages to have UNSAFE code blocks, 10 years before C was even an idea. Before that there was JOVIAL as well, https://en.wikipedia.org/wiki/JOVIAL https://en.wikipedia.org/wiki/JOVIAL
  - LargoLasskhyfv 5y ago
    Hasn't that morphed into some sort of emulation nowadays? Like almost COTS(common of the shelf) Xeon, running some hypervisor and the 'legacy' within? Similar to what Symbolics did with Genera for Alpha? edit: [1] https://microsites.unisys.com/offerings/clearpath-forward https://microsites.unisys.com/offerings/clearpath-forward [2] https://docs.microsoft.com/en-us/azure/architecture/example-scenario/mainframe/unisys-clearpath-forward-mainframe-rehost https://docs.microsoft.com/en-us/azure/architecture/example-... Azure?! Err...sure...
    - pjmlp 5y ago
      First of all it depends on the customer deployment scenario. Secondly, having an issue with number 2 cloud provider at world scale? Or would you rather have AWS?
      - LargoLasskhyfv 5y ago
        That's not what I meant to say. It doesn't matter which cloud provider at all, if the product running on it is an emulation. All the assurances you spoke of regarding early Burroughs Large Systems resulted from hardware/software co-design. The hardware does not exist anymore. They ported some abstraction layer by whichever means to contemporary platforms, and now top that by making it available to the cloud, saying: 'Diz iz good! We king of the mainframe hill, Ugga Ugga!' I wouldn't trust that. The same way I wouldn't trust that from another, very established competing vendor, saying the same things, having the same nimbus of security and reliability. Because sometimes there are blips on my radar, wherein some conference talk pops up, and people looked under the rugs of these systems, not even hard, just casually, and discovered some oopsies. So it seems like that nimbus of security and reliability is more a result of very careful isolation from public networks on one hand, and inacessability for the bored and curious pranksters of the world on the other. But it is no absolute. Especially if it's running in emulation on contemporary COTS hardware. (In the EFFING cloud!) Just my not so humble opinion, though.
native_samples 5y ago
I find Snowden's take on software engineering to be poorly reasoned and internally inconsistent. The most important fact related to his argument is one he doesn't even bother mentioning, namely that Android is mostly written in a memory safe language (Java). The thing he's asking for already exists and is deployed on most smartphones worldwide, yet all he has to say on the topic is this: "While iPhones are more private by default and, occasionally, better-engineered from a security perspective than Google’s Android" You cannot claim to be a spokesman for freedom, then demand memory-safe languages be used everywhere, and then praise the one system controlled exclusively by a single American firm that's written almost entirely in (Objective) C, a memory unsafe language. That sentence is the only mention of Android in the entire article, the word "Java" doesn't appear anywhere and he seems to think that Rust is the only memory safe language in existence. Why should I care about this guy's opinions? Java has been drastically more successful than Rust when it comes to making software memory safe. Nobody is gonna choose to write the next AirBNB in Rust other than for fashion reasons, because it'd simply be too unproductive. Developers already complain about Swift and its horrible compile times, Rust would be even worse. If Snowden really cares about this topic, he should brush up his Java skills, download some OpenJDK early access builds and start experimenting with writing video codecs and 3D engines using the new vectorization, memory span and value types features. Java is getting the capabilities to do even higher performance work traditionally dominated by C++, but in ways that preserve memory safety. The engineering is very difficult and it's unclear if Google will ever adopt it into ART, but it's there for them if they want it.
- forty 5y ago
  Which part of Android is written in java? The kernel? The drivers? The JVM ? I somehow doubt anything significant of the OS itself is written in java :)
  - native_samples 5y ago
    Which parts? I'm surprised this isn't well known already. Large parts of Android are written in Java. Amongst other things: * All the UI libraries, networking APIs code. * All the system apps and services like the home screen, the keyboard, the system server, the window manager, the telephony subsystem (very important!) and so on. * Many of the system APIs including services like the alarm manager, dropbox manager, some cryptography services, location services etc. * The entire developer toolchain: the build system and the IDE. * All the client logic for Google Play Services, which is a big part of the overall Android API now. * Large parts of the compatibility test suite. * The standard libraries for all the above. Just browse through the code and see for yourself: https://cs.android.com/android/platform/superproject https://cs.android.com/android/platform/superproject Most of the Java code is under the frameworks directory. No, not all Android code is written in Java. Lots of devs want to be able to use C++, and for some things its necessary. The point of the upgrade projects I just mentioned is that they are tackling the remaining cases where C++ can outcompete Java for things like media codecs. And the Java world has developed a JVM written in Java, actually several of them, so whilst Google hasn't done it, the tech is actually there. All this exists today, whereas an entire widely adopted consumer OS written fully in Rust is only a pipe dream. Oh, and as for drivers, Google moved drivers out of the kernel and into user space some time ago (Project Treble): https://source.android.com/devices/architecture https://source.android.com/devices/architecture You can in fact now write drivers in Java. Google recommend you don't, but it's architecturally possible: https://source.android.com/devices/architecture/hidl-java https://source.android.com/devices/architecture/hidl-java
imdoor 5y ago
> Fixing the hardware, which is to say surgically removing the two or three tiny microphones hidden inside, is only the first step of an arduous process, and yet even after days of these DIY security improvements, my smartphone will remain the most dangerous item I possess. What's the purpose of these microphones? Do they pose more threat than the standard non-hidden microphone?
- z77dj3kl 5y ago
  I think he's referring to the standard, non-hidden microphones.
- aaronmdjones 5y ago
  I believe he's referring to the various MEMS sensors (accelerometer, gyroscope, etc) which can be repurposed into microphones (much like harddrives).
- olabyne 5y ago
  These are the "standard microphones" of any modern smartphone. One microphone at the bottom, for calls, and 1 or 2 at the top, for stereo sound while recording videos and noise cancelling while doing call
dxuh 5y ago
Everyone in these comments mentions C and C++ as a single word, which frankly has nothing to do with reality. C++ is a FAR safer language than C, if you wish to use it properly (which many don't). I write C++ full time at work and I also use it a lot in my free time and I rarely if ever have out of bounds accesses, use after free or any of these bullshit errors. If you use modern C++ and AdressSanitizer and don't do anything too "fancy" then it's very hard to get those types of bugs. I firmly associate them with C and C alone. These time are over for modern C++. The people commenting here clearly have no idea what modern C++ even looks like.
- hawski 5y ago
  As much as like C and dislike C++ you are right.
- eandre 5y ago
  The problem for modern C++ is that few (or zero?) code bases contain exclusively "modern C++" when you include all transitive dependencies. You end up using a huge amount of C and "legacy C++" just by virtue of reusing code.
  - snovv_crash 5y ago
    This is true for Rust as well though.
- pjmlp 5y ago
  Because even companies like Microsoft and Google don't write modern C++, you can easily validate this on their public repositories. See how much modern C++ you will find in AOSP and NDK, WinUI or XBox code samples. Modern C++ exists only at talks in CppCon, C++Now.
- x4e 5y ago
  C++ can be safer but that does not mean it is safe. The fact you have out of bounds accesses, even if it is rare, is not really acceptable in a language that would like to be considered “safe”.
n0on3 5y ago
I think we already know how to build secure tech, we just don't because of the cost, which is not 2x or 10x but way higher to the point that is deemed not worth/feasible both for private companies and governments, so it affects everyone and we are not getting out of it anytime soon (if anything sometimes we go in the opposite direction following the goal of money and calling it innovation). Heck, I think it would take a book just to even explain all the components of this argument. Go figure do something meaningful about it. Safe/unsafe languages is just one piece of this thing, and frankly a quite easy one to wrap one's head around: we already have so much stuff we use everywhere written when memory-safety was not really cared for and no-one wants to rewrite / catch up / surpass (there you go: because of the cost). So we get on with it, because meanwhile life goes on, bread needs to put on the table, people want to play with their shiny phones and whatnot, etc.
pjmlp 5y ago
"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quickly Mark Zuckerberg would start smashing the delete key. Where there is no liability, there is no accountability... and this brings us to the State. " Yep, this definitly needs to eventually happen.
- kragen 5y ago
  If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.
  - grncdr 5y ago
    How would this make running a personal website risky from a legal liability perspective?
    - kragen 5y ago
      Are your HTTPD logs adequately secured? Are their security measures audited monthly, in keeping with established industry best practices? Do you have comments enabled on your blog? What's your policy for expunging blog posts about people exercising their right to erasure? How did this defamatory comment spam get past your comment filter? Did you know your open-source image thumbnailing software is being used on an illegal pornography site? Why didn't your legal office respond within 8 hours when you were notified of a privacy invasion on your blog last Saturday?
      - grncdr 5y ago
        What a load of FUD. Personal websites don't need anything more complicated than an out-of-the-box config for apache or nginx to serve static files out of webroot. When's the last time that kind of setup was exploited? Sure if you add more complexity, you add more attack vectors, but there's an easy way to reduce your legal culpability there: just don't collect any PII. Even in the scenario you propose where anonymous HTTPD logs are a liability (which... yeah, is not going to happen any time soon) the solution is simple: turn off logging. If the legal precedent is established, the defaults of our software will change to match.
Synaesthesia 5y ago
The problem is bigger than hardware and software being "insecure" it's got ultimately to do with trust of these corporations. Do we trust that Apple, Google and so on will do the right thing? If not maybe we can construct new (maybe public) companies which are accountable for our privacy. Or hold existing companies accountable. Its going to need a huge swing of power towards ordinary people though.
minusSeven 5y ago
Do people really think any of this is ever going to change? Governments don't give a shit, they time and again say they won't do something only to later do it in secret. We should at this point accept that this isn't going to change and move ahead with the belief that your data is already hacked and is not private anymore. We should discuss more on the exact consequences of this and take actions accordingly.
- Synaesthesia 5y ago
  So not point in ever doing anything? Just give up. A mass movement of people can force a government to change.
  - deleted 5y ago
    [deleted]
  - minusSeven 5y ago
    Do people stop doing crimes because laws have made it illegal. I am saying there is no point trying to stop what is inevitable instead our energies are better spent trying to understand how best to navigate an online world without any privacy. Right now many western nations are involved in Pegasuses, what happens when China gets involved. We will have absolutely no control over what China does, especially when no country will publicly acknowledge that we are spying on people.
- deleted 5y ago
  [deleted]
joelbondurant 5y ago
Queue the smarmy communists to discuss the holy religion of bully state solutions.
m12k 5y ago
Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were selling nukes.
- yabones 5y ago
  It's even more insane when you remember that strong encryption was regulated as munitions until the mid 90s [1,2] - and actual cyber-weapons aren't today. Software that can cause real damage to not just data and business activities, but endanger lives is completely legal to sell to despotic lunatics. If you sold a bag of fertilizer to a Syrian you'd go straight to Guantanamo, but somehow this is okay. [1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [2] https://web.archive.org/web/20051201184530/http://www.cyberlaw.com/cylw1095.html https://web.archive.org/web/20051201184530/http://www.cyberl...
- tim333 5y ago
  Laws are made by the government of the country in question and in this case the government, Israel, approved the sales and used them to its advantage.
- aj3 5y ago
  LEO and TLA need vendors with constant supply of exploits.
- red_trumpet 5y ago
  Iirc the software sold by the NSO group is considered a weapon under Israel law, so it is somewhat regulated. Not as heavily as nukes though. This begs the question: Is there a compelling reason why selling weapons to other states should be legal?
  - iFreilicht 5y ago
mark_l_watson 5y ago
Great article that I am sharing with non-tech friends and family. The most powerful point is to stop using unsafe programming languages. I usually use Common Lisp (for almost 40 years now), but I have been experimenting a lot with Swift over the last year. I have little experience with Rust. I have seen comments that Swift and/or Rust are not appropriate for operating systems and general systems programming, but I call bullshit on that. The problem is a financial problem, expensive to pay for difficult to hire Rust and Swift developers to rewrite billions of lines of code. But it should be done. I pay an incredible amount of money to Apple every year and I expect it from them. Same for Microsoft customers (and Google).
bob1029 5y ago
> The greatest danger to national security has become the companies that claim to protect it No. The greatest danger is lack of software supply chain management followed by near-universal disrespect for formal complexity management methods. The only way I have found to win at this "are we actually secure" game is to minimize the number of parties you have to trust. The smaller you get this figure, the easier it becomes to gain control over your circumstances again. How many of us can immediately state the exact number of unique parties that we have to trust as part of building solutions for other people? What about complexity? Most of the time, something is insecure not because of malicious intent (covered by the trust angle above), but because its so goddamn complex that no one can say for sure if its correct or not. Why do we tolerate this?
- ncmncm 5y ago
  There is no supply-chain accountability without liability. When adding a dependency, knowing it exposes you to prosecution if it becomes a vector for security violation would give pause. A premium on attested-secure components might develop. If Facebook depended on Zst being secure to be able to stay in business, we might be more inclined to use Zst than e.g. unmaintained Zlib.
  - ryandrake 5y ago
    Coming from embedded/avionics, it's shocking how careless and cavalier the rest of the development industry is about their dependencies. At most places, outside large FAANGs that bake external dependency reviews into their process, the process is: 1. Developer has a problem to solve 2. Developer does a few web searches and finds libXyz, which looks like it solves the problem. 3. Developer tries libXyz and it solves the problem. 4. Yolo! A libXyz dependency is added, and now it's part of the product that the company stakes its name and reputation on. Total madness. What else does libXyz do? What data does it collect? What does it do with that data? What bugs does libXyz have, and do they put our product at risk? What about security risks? Does libXyz have tests, and do they pass? How extensive is its test coverage, and would that be sufficient at our company? Does libXyz impact the overall performance of our product? What is its maximum memory footprint? Does libXyz limit our product to a particular architecture? What is libXyz's license, and is it compatible with our product? Who is responsible if libXyz fails and our company gets sued? You're lucky if the developer even thinks about one or two of these, let alone fully auditing the library. Staking your product on the suitability of a library but not actually thoroughly vetting the library. And some products out there have hundreds of dependencies, all added in the manner described above. We're just handing out loaded guns.
raman162 5y ago
I definitely agree with Snowden's call to action with making spyware illegal, I think the execution is plausible but unlikely for the same reasons he stated in the article. Every country is working to produce these things themselves for cyber security self defense. I am unsure about his comments regarding unsafe code. Like many of the people have already stated here, that's a blurry line that has good intention but seems nearly impossible. I think more regulation and certification for both employees and companies is a much more likely to be successful.
rsanek 5y ago
>If hacking is not illegal when we do it, then it will not be illegal when they do it—and “they” is increasingly becoming the private sector. Not sure I follow the logic here. The State has a monopoly on many things that are never allowed in the private sector -- violence being the most obvious one. We don't seem to have a huge problem with the split here; why we couldn't do the same for hacking?

743 points by stanislavb 5y ago

Loved seeing language safety features called out. How can we prevent monoculture yet retain interoperability and profitability? Are these inherently at odds?

mikewarot 5y ago
Diversity can help improve interoperability, if everyone sticks to only the public APIs and protocols, you can cross-run unit tests and make sure that everyone passes all of the unit tests for all implementations, and yield the same results, the only difference should be in performance. Like farming, monocultures seem profitable, until the pests show up, and can swamp out all of the advantages.

keeganjw 5y ago

TIL Edward Snowden has a substack.

deleted 5y ago

[deleted]

bambax 5y ago

> it is still hard for many people to accept that something that feels good may not in fact be good This strikes me as surprising. I have always been taught the opposite: if it feels good, it's probably bad for you, or illegal, or immoral, or all three.

ASalazarMX 5y ago
I'd take out the immoral, as it feels puritan. Also, there are nice things that are good, legal and moral, like stretching after a good night sleep, a professional massage, ad blocking, etc. Maybe I'm being too literal here.
- dylan604 5y ago
  Yeah, I'm sure there are some that would think ad blocking as immoral as you're "trying o get something for free" blah blah As puritan as it feels, a large part of the population likes it that way and want it even more strict.
- npteljes 5y ago
  I love it that you included ad blocking as moral. Absolutely agreed.
koolba 5y ago
> if it feels good, it's probably bad for you, or illegal, or immoral, or all three. Pretty much. The only exceptions I’ve found are exercising and saunas.
- hashkb 5y ago
  Creating art can feel pretty good. Most art is legal these days.
tomc1985 5y ago
Protestant Western propaganda at its finest
low_tech_love 5y ago
Interesting, when I read that line I thought the exact opposite. It sounds exactly line how I feel about the people around me.

deleted 5y ago

[deleted]

o8r3oFTZPE 5y ago

[accidental dupe. see above comment]

tootie 5y ago
Who dismisses it? I think it's a pretty good idea. I think an enforceable law would have be more thoughtful than just paying for every breach. We need a reasonable standard for responsible security and how to assign blame.
michaellee8 5y ago
I bet aoftware that is so secure to be compared to products of other engineering fields does exist (e.g. avionic systems), but you will have to pay a much higher cost to use it, luke hundreds of thousands dollars since the cost of acheieved the guaranteed security level would also be much higher. Given the low cost of modern consumer software, you really have to understand that you get what you paid for. And if you want security guarantees you don't just need that particular piece of software being secure, you need qualified people to operate it, the hardware running it being secure (probably propietry and cost hundreds of thousands), and the whole software stack being secure as well, from firmware to OS to networking code. This is simply not somehow that your general consumer can afford, and if you enforce that level of security in consumer software like smartphones, it is safe to bet that almost everyone that has a smartphone would be protesting since they would have no Software aviliable on there phone anymore. Like one comment above said, there do exist ways to enforce that level of software security, (like railway traffic lights) but the cost would be ridiculously high, and those systems are probably not running any consumer kind of software stack, probably without an OS since Linux would has it own vulnerability as well. Those systems are probably made for custom hardware that the software vendor has total control of it as well.

mikewarot 5y ago

I was all ready to post a reply... when I was hit by the darkest pattern of all... you must pay to do so, with no hint prior to that moment.

dcow 5y ago
Substack replies are paid? Hmm. Thinking about this right now: annoying sure but why do you consider this pattern dark? I bet it reduces spam and trolling by orders of magnitude unlike say confusing cookie dialogs designed to make you surrender all your private info.
- DantesKite 5y ago
  Seems like it would lead to marginally better discussions too. Or at least, very very heated ones.
- ManuelKiessling 5y ago
  The dark pattern is that you don’t know it beforehand, not the paywall itself.
  - littlestymaar 5y ago
    You know before typing your comment though. The real dark pattern would be if it had let you type and then ask for money to submit your comment.
    - arc-in-space 5y ago
      You do have to start typing before it informs you, which means you already had a reply in mind. I agree that's pretty bad.

o8r3oFTZPE 5y ago

"For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product." That sort of discussion is quickly dismissed on HN. And probably elsewhere on the web/over the internet. Instead we frequently see discussion blaming users of the software, i.e., Microsoft's customers, or even suggestions to make the customer liable, or comments from "security experts" on how Microsoft has made such amazing strides in securing Windows (a tangent). In the real world, outside the Redmond/Silicon Valley monopoly space, how many mistakes does someone have to make before we start to suspect there might be problems with relying on that person's work. Even more, how many times do we hire someone knowing they have made 500+ mistakes in prior work leading up to their application. If Microsoft products are so infallible when used as instructed by Microsoft, then why would Microsoft have a heart attack as Snowden suggests. What a remarkable state of affairs we have today where employers such as Microsoft can call their employees "engineers", and yet both the employer and employees are absconded from any liability for the so-called engineer's work. The number of "second chances" Microsoft gets is nothing short of astounding. A bit like the number of pardons we allow to Google or Facebook for privacy infractions. Infinite. https://www.nspe.org/resources/professional-liability/liability-employed-engineers https://www.nspe.org/resources/professional-liability/liabil...

ChrisMarshallNY 5y ago
Regardless of all that, I would love to see a big improvement in basic software Quality. Easy to say; not so easy to do. It is actually difficult to answer the [seemingly] simple question “What, exactly, is ‘Quality’?”. I think I do a fairly good job, there, on my own work, but what works for me, won’t work for most.
maliker 5y ago
My guess is the ‘users didnt know what they were doing defense.’ Not that you can deploy software in a secure by default stance. But once somebody sets up users and a million other settings inside Active Directory, it’s pretty much bound to be insecure. And then the defense is akin to ‘you werent supposed to crash the car into the tree’.

fungiblecog 5y ago

Nothing will change

rvz 5y ago
They will never change. It's only going to get worse as the world enjoys their new remotely controlled telecommunications devices.
swiley 5y ago
Maybe we'll get open source drivers and have the PostMarketOS devs handle it.
- npteljes 5y ago
  I think this is the most we can strive for: a sustainable niche alternative.
meowface 5y ago
Eh, I think it's plausible that in 20 years almost all critical code will be written in memory-safe languages and that this particular bug class will essentially be eliminated for new software. There'll always still be RCE bugs of some kind, but it's probably going to get harder and harder to find them, exploit them, and escape sandboxes and mitigations.

2OEH8eoCRo0 5y ago

Edward Snowden is a traitor or a coward. Daniel Ellsberg gave the pentagon papers to the press after trying to give them to Congress. He then fought the govt in court and won. Ellsberg is a patriot.

lu4p 5y ago
No he's not, he even stated, that he is fine with coming back to the US if he is guaranteed a fair trail. https://www.washingtonpost.com/news/the-switch/wp/2015/10/06/edward-snowden-says-he-would-go-to-jail-to-come-back-to-the-u-s/ https://www.washingtonpost.com/news/the-switch/wp/2015/10/06...
- throwmeawayya 5y ago
  Did the US government explicitly deny him a fair trail?
  - sydthrowaway 5y ago
    Look at the dirty tricks they employed with Assange. Snowden’s paranoia has been vindicated.
    - fortuna86 5y ago
      Assange is in prison in England.
    - pstch 5y ago
      It's not even paranoia. He wants to present reasons of his actions, and the judicial authorities won't allow that, and are not even really hiding it.
  - fortuna86 5y ago
    Did the FBI deny D.B. Cooper a fair trial?
- 2OEH8eoCRo0 5y ago

_wldu 5y ago

Nice to see that he linked to rust as a safe alternative to the C's (C, C++, Objective-C). There is a place for Go and Java as well above the system level. Both perform well and are safe.

zozbot234 5y ago
Go is not safe for concurrent code, unfortunately. Specifically, it does not protect against data races on non-atomic types, which can lead to torn writes and break invariants that are required for safety.
- lu4p 5y ago
  True, but still memory safe, also Go has a race detector included which is really easy to use https://blog.golang.org/race-detector https://blog.golang.org/race-detector
  - roca 5y ago
    No, Go is not memory safe for concurrent code. Race detection is good but can't eliminate races altogether.
    - pjmlp 5y ago
      Same applies to Rust as well actually. Its type system only prevents data races for in-memory data structures, on the same OS process. There are plenty of other concurrency races.
      - roca 5y ago
        It's true that there are "higher level" races that Rust can't prevent. But in-memory races are particularly important to prevent, because a) they're a common and very nasty kind of bug and b) it means unlike Go, Rust (the safe subset) is memory safe (and in general, free of undefined behaviour) for concurrent code.
- 5y ago

spoonjim 5y ago

I thought this was going to be about Instagram making money by making people, especially women, feel worse about themselves. Turns out there are multiple insecurity industries operating today...

3pt14159 5y ago

I'm not going to comment on Snowden's view of what liberal western states do when it comes to surveillance. I have my own opinion, but he's been right about stuff I'd disagreed with him in the past before so I'm gun shy about confronting his ideas again. On the topic of unsafe language though, he's absolutely right. We don't have to put up with this. We could pass a law and ban new code in unsafe languages from national security threatening devices like phones or cyberphysical devices like self-driving cars and we would be the better for it in under a decade. We could even have taxes to give breathing room during a transitionary period to encourage it before outright banning it, but we don't. We don't because so often it is less of a hassle for the government to trust the private sector that it is to take some real position on the regulatory issues that matter. This will probably always be the case until the government is able to evaluate talent and pay salaries in accordance with that talent as the private sector is.

SV_BubbleTime 5y ago
If there is one thing politicians are surely better at it than programmers is making decisions about what programming languages should be used! /s Yes on theme, but no on ”there aught to be a law” that bans C/C++ because of an evolving goal of memory safety. When Rust++ comes out surely there will be people complaining that Rust isn’t safe, and so on. Best case is you make the consequence punishable (as was described in the article).
- mikepurvis 5y ago
  Other industries handle this kind of thing with a layer of indirection: instead of laws from the state, the state imbues a professional body with certification power, and the body sets standards by consensus or whatever other process among their members. So if you're an architect, or lawyer, or tradesperson, or whatever, you have to do things in the manner prescribed or you lose your license. I know this kind of thing is a lightening rod for a lot of software folks, but it does have the nice property that it's proactive; you don't have to wait around for the obviously-unsafe practice to blow up in someone's face before you can do something about it. And no one wants to have to get licensed to write some crud app in NodeJS. But maybe these kinds of high-stakes modules related to encryption, security, and so on could be a place to start with it; if you're going to work in these areas, and offer your work to the public (for money or otherwise), then you either need to be licensed by the professional body, or clearly advertise in the header of each file that the work has not be overseen by a licensed professional. That's the kind of arrangement that could do things like specify languages, methods, interfaces, and so on.

lifeisstillgood 5y ago

I tend to bang on about software not as engineering but as literacy. It makes some sense even here - that bad code is as common as bad law - and often for the same reasons, politics, money, and hard questions "Engineering" is a wide subject - the big stuff is carefully built and highly regulated - bridges and buildings. But as we go down the scale we see engineering give way to the problems of politics and money - tower blocks collapse for example, and then we see human level engineering - factory tools that try to meet inflicting goals, dangerous toys and so much more. The software world should not beat itself up for not being like all those engineers - when lives are not on the line engineers get tied up just the same as the rest. And when lives are on the line, software and hardware engineering have learnt a few things - reduce the scope to the barest possible essentials - have a lot of redundancy and stick to well known designs.

jonas21 5y ago
Also, traditional engineers design things to withstand conditions that they would reasonably face in ordinary use, with some additional safety factor. They don't design them to withstand deliberate attacks by nation-level actors like we're seeing here. If a car explodes because it got hit by an artillery shell, would anyone hold the automotive engineers responsible? If a building collapses because a bomb was dropped on it, would anyone hold the civil engineers responsible?
- andyferris 5y ago
  This is an interesting point. I think the difference here is that no car could be engineered to withstand an artillery shell, whereas we can imagine an iPhone not susceptable to this particular vulnerability (it already exists). Perhaps one argument is that the space of _potential_ vulnerabilities in something as complex as an iPhone is so huge that it just isn't feasible to create one that can withstand all network-based attacks (in which the attacker hasn't obtained user consent, Apple's signing keys, etc)? However I'm not sure if I buy that argument, or not...
- dylan604 5y ago
  That depends really. In the US, nuclear power plants are supposed to be able to withstand a certain amount of damage, specifically a direct impact of a certain sized plane (even before 9/11). So, like all things, it's a bit of a matter of perspective.

siliconc0w 5y ago

I don't think you'd have to ban unsafe languages but you could pass a law that slowly decreased the amount of money the government could spend on 'unsafe' software (either through direct licensing or renting through clouds). The government is such a huge client to these companies that it'd immediately create a large financial incentive to migrate.

staticassertion 5y ago
I think this is probably one of the better, more practical ideas that I've seen. If the government has to consider whether the underlying technology has adequately addressed memory safety issues (doesn't have to be at a language level, but that's obviously the easiest way), that puts pressure on them to fund projects that use memory safe approaches. That's billions of dollars that will get slowly steered in the right direction.
- BruiseLee 5y ago
  And naturally the ones to decide which software is unsafe will be the lobbyists from the most powerful tech companies like Microsoft or Google.
  - staticassertion 5y ago
    Not really, no.

deleted 5y ago

[deleted]

rognjen 5y ago

While his message is undoubtedly important I find his writing style is overly condescending and detracts from the message.

ramraj07 5y ago
He probably has earned the right to be condescending as much as say Linus has. Dude risked it all to expose what he thought was wrong, and only someone as smart as him could have managed to stay alive and out of jail (albeit barely) facing off the most powerful country in the world.
- rognjen 5y ago
  Messages from public advocates should be delivered with more tact and understanding if you're serious about influencing public opinion. For instance, if you like the Washington Post, and read this article you'll be quite annoyed at the "have to lose your spine" remark. The message is then diluted. If you're just a regular consumer who likes the iPhone you'd be annoyed at the latte status symbol quip. The message is then diluted. I don't think comparison with Linus is equivalent because he doesn't publicly advocate much whereas that's mainly what Snowden does. (Perhaps I should have included this in the original comment.)
- cf499 5y ago
  "He probably has earned the right to be condescending as much as say Linus has." It's not about rights, it's about desires and personal insecurities. People who derive pleasure from condescension are just telling you that they're vulnerable to manipulation via flattery. It's bad opsec! :P
larsiusprime 5y ago
C'mon. Compared to what I'm used to from the median big shot internet blogger or NYTimes op-ed page, Snowden is positively pulling his punches here.

AlexCoventry 5y ago

> iOS's update model is 1000% better than Android's, which is a massive security improvement against most threat actors (who aren't using artisanal Israeli zero-day exploits). What are the advantages of iOS's update model?

edrxty 5y ago
Software updates actually occur for old hardware. Android almost never gets updates for anything older than a couple years. I hate iOS for it's walled garden bullshit but android seems to have found the one way to be worse.

wly_cdgr 5y ago

I doubt "real" engineering is better. It's just that attacking its artifacts doesn't scale, so it looks more secure. In fact, the average bridge or skyscraper is probably absolutely riddled with serious design and manufacturing flaws

imwillofficial 5y ago
The design process is pretty rigorous. Anything to back up your idea?
- jchook 5y ago
  Not necessarily agreeing but reminded of the Harvard Bridge in Boston. I heard that though it was often called the MIT bridge (because it connects MIT campus to Boston), they felt fine with the name “Harvard” after learning it was structurally unsound. https://en.wikipedia.org/wiki/Harvard_Bridge https://en.wikipedia.org/wiki/Harvard_Bridge
  - wly_cdgr 5y ago
    Smoots would have been ashamed, smh....
- wly_cdgr 5y ago
  Challenger, Columbia (safety culture at NASA really improved after Challenger huh), Chernobyl, Three Mile Island, Fukushima, recent FL condo collapse, my average five story Brooklyn apartment building's basement and roof after a thunderstorm, Boeing's long and growing list of recent fuckups... is some stuff that comes to mind off the top of my head. Makes you wonder how many close calls, less major incidents, cracks that are noticed and repaired in time, buildings that happen to be demolished twenty years before collapsing to make way for redevelopment, etc we don't even hear about, no? What about you - anything to back up your claim?
  - deleted 5y ago
    [deleted]

high_byte 5y ago

>basically turns the phone in your pocket into an all-powerful tracking device that can be turned on or off, remotely, unbeknownst to you, the pocket’s owner even more so with Android & iOS.

KirillPanov 5y ago
Targeting those is for n00bs. Backdooring the modem firmware is far more useful, and reliable. Not to mention undetectable -- not only is the user unable to recompile or replace this firmware, they can't even get a checksum of it. Qualcomm's modem chips get their own private NAND flash that they can use as they please.
- dylan604 5y ago
  Thanks for that. I'll sleep well now. These are the litteral nightmare scenarios.
- quenix 5y ago
  Realistically, how useful is compromising modem firmware if like 98% of communication done through it is encrypted at the AP level? It’s sorta like wiretapping a fiber optic cable—okay, what now?
  - KirillPanov 5y ago
    On SoCs with an on-chip modem, the modem can write to any part of host memory it likes. No IOMMU. On the (very) few remaining phones that use two separate chips, what do you think the odds are that the host OS is hardened against attacks originating from its own modem? That is a hideously complicated protocol spoken between the modem and the host processor. Plenty of validation+overflow footguns. Finding exploits here isn't going to get security researchers promoted, if they can find them at all. "Exploit is available only to modem manufacturer" does not engender a high CVE score. Oh, and, just to top it off, that interface between the modem and the host processor when they aren't on the same chip is... drum roll... USB. As in, BadUSB. As in, Mr. Phone says: "wow, somebody plugged in a USB keyboard! And a USB mouse!". But hey, the modem doesn't even need to own the CPU. It can record and exfiltrate your GPS location quite happily via LTE, all on its own. And buffer up a nearly unlimited amount of location data on that private NAND flash it has in case you're out of cell range. All while pinky-swearing that location services are definitely absolutely turned off, promise. I don't know why people believe that location-tracking is ever turned off on a phone; it's just absurd to think that.

nxpnsv 5y ago

Off topic: I counted no less than five different subscribe buttons. Is that the point of diminishing returns?

pyuser583 5y ago

Is Python a safe language? It doesn’t seem to have the sorts of problems other languages do. Why is that?

franga2000 5y ago
Most interpreted languages are "safer" in this regard as they don't leave the memory management up to their users. The interpreter itself could still have such bugs, but that's a comparably much smaller attack surface and has far more eyes on it that any random person's code, so these are less frequent. And it's not just fully interpreted languages - any language that manages memory for your and doesn't let you mess with it yourself (like Java, C#...) will be safer, assuming the compiler and runtime are secure.
aix1 5y ago
There are at least two things that could be contributing to this perception: 1. Python is (usually) an interpreted language, and it's probably true to say that interpreted languages tend to have a lower attack surface (at the cost of lowered performance). 2. While Python is very popular in certain domains (numerical computing, ML etc), there are few low-level systems that are written in Python.
7373737373 5y ago
Absolutely not, unfortunately. One of the architectural issues plaguing even comparatively memory-safe languages is the fact that there is a global scope that's accessible from anywhere. In some Python versions even numbers or truth values could be redefined. [0] This makes it impossible to sandbox functions or imported modules, because they can communicate arbitrarily. But communication/access security is not the only problem. Resource security is something I haven't seen any significant language (besides Java perhaps) try to approach - being able to limit the memory and cpu usage of a (part of a) program. Modern languages should make it possible to do both with just a few lines of code. I recommend reading about Capability Security[1], the E language[2] and the Principle of least Authority (POLA) [3] [0] https://hforsten.com/redefining-the-number-2-in-python.html https://hforsten.com/redefining-the-number-2-in-python.html [1] http://www.cap-lore.com/CapTheory/ http://www.cap-lore.com/CapTheory/ https://en.m.wikipedia.org/wiki/Capability-based_security https://en.m.wikipedia.org/wiki/Capability-based_security [2] http://www.erights.org/ http://www.erights.org/ [3] https://medium.com/agoric/pola-would-have-prevented-the-event-stream-incident-45653ecbda99 https://medium.com/agoric/pola-would-have-prevented-the-even... These originated in the mainframe era, in a connected world before the internet, at the inception of the first multi-user systems: https://github.com/void4/notes/issues/41 https://github.com/void4/notes/issues/41

DoingIsLearning 5y ago

It feels like we've gone full circle back to 1980 when the US Defense comissioned a 'safe' embedded language. Jean Ichbiah's team won this contract with the language 'Green' in 1979. They subsequently went on to further develop this and standardize it in what was then the Ada 83 language standard. The more I think about the more it feels that Ada just came about to solve the right problem but at the wrong time.

pjmlp 5y ago
Unisys still sells Burroughs to customers that care about top level security. https://en.wikipedia.org/wiki/Burroughs_large_systems https://en.wikipedia.org/wiki/Burroughs_large_systems ESPOL/NEWP were the very first system programming languages to have UNSAFE code blocks, 10 years before C was even an idea. Before that there was JOVIAL as well, https://en.wikipedia.org/wiki/JOVIAL https://en.wikipedia.org/wiki/JOVIAL
- LargoLasskhyfv 5y ago
  Hasn't that morphed into some sort of emulation nowadays? Like almost COTS(common of the shelf) Xeon, running some hypervisor and the 'legacy' within? Similar to what Symbolics did with Genera for Alpha? edit: [1] https://microsites.unisys.com/offerings/clearpath-forward https://microsites.unisys.com/offerings/clearpath-forward [2] https://docs.microsoft.com/en-us/azure/architecture/example-scenario/mainframe/unisys-clearpath-forward-mainframe-rehost https://docs.microsoft.com/en-us/azure/architecture/example-... Azure?! Err...sure...
  - pjmlp 5y ago
    First of all it depends on the customer deployment scenario. Secondly, having an issue with number 2 cloud provider at world scale? Or would you rather have AWS?
    - LargoLasskhyfv 5y ago
      That's not what I meant to say. It doesn't matter which cloud provider at all, if the product running on it is an emulation. All the assurances you spoke of regarding early Burroughs Large Systems resulted from hardware/software co-design. The hardware does not exist anymore. They ported some abstraction layer by whichever means to contemporary platforms, and now top that by making it available to the cloud, saying: 'Diz iz good! We king of the mainframe hill, Ugga Ugga!' I wouldn't trust that. The same way I wouldn't trust that from another, very established competing vendor, saying the same things, having the same nimbus of security and reliability. Because sometimes there are blips on my radar, wherein some conference talk pops up, and people looked under the rugs of these systems, not even hard, just casually, and discovered some oopsies. So it seems like that nimbus of security and reliability is more a result of very careful isolation from public networks on one hand, and inacessability for the bored and curious pranksters of the world on the other. But it is no absolute. Especially if it's running in emulation on contemporary COTS hardware. (In the EFFING cloud!) Just my not so humble opinion, though.

native_samples 5y ago

I find Snowden's take on software engineering to be poorly reasoned and internally inconsistent. The most important fact related to his argument is one he doesn't even bother mentioning, namely that Android is mostly written in a memory safe language (Java). The thing he's asking for already exists and is deployed on most smartphones worldwide, yet all he has to say on the topic is this: "While iPhones are more private by default and, occasionally, better-engineered from a security perspective than Google’s Android" You cannot claim to be a spokesman for freedom, then demand memory-safe languages be used everywhere, and then praise the one system controlled exclusively by a single American firm that's written almost entirely in (Objective) C, a memory unsafe language. That sentence is the only mention of Android in the entire article, the word "Java" doesn't appear anywhere and he seems to think that Rust is the only memory safe language in existence. Why should I care about this guy's opinions? Java has been drastically more successful than Rust when it comes to making software memory safe. Nobody is gonna choose to write the next AirBNB in Rust other than for fashion reasons, because it'd simply be too unproductive. Developers already complain about Swift and its horrible compile times, Rust would be even worse. If Snowden really cares about this topic, he should brush up his Java skills, download some OpenJDK early access builds and start experimenting with writing video codecs and 3D engines using the new vectorization, memory span and value types features. Java is getting the capabilities to do even higher performance work traditionally dominated by C++, but in ways that preserve memory safety. The engineering is very difficult and it's unclear if Google will ever adopt it into ART, but it's there for them if they want it.

forty 5y ago
Which part of Android is written in java? The kernel? The drivers? The JVM ? I somehow doubt anything significant of the OS itself is written in java :)
- native_samples 5y ago
  Which parts? I'm surprised this isn't well known already. Large parts of Android are written in Java. Amongst other things: * All the UI libraries, networking APIs code. * All the system apps and services like the home screen, the keyboard, the system server, the window manager, the telephony subsystem (very important!) and so on. * Many of the system APIs including services like the alarm manager, dropbox manager, some cryptography services, location services etc. * The entire developer toolchain: the build system and the IDE. * All the client logic for Google Play Services, which is a big part of the overall Android API now. * Large parts of the compatibility test suite. * The standard libraries for all the above. Just browse through the code and see for yourself: https://cs.android.com/android/platform/superproject https://cs.android.com/android/platform/superproject Most of the Java code is under the frameworks directory. No, not all Android code is written in Java. Lots of devs want to be able to use C++, and for some things its necessary. The point of the upgrade projects I just mentioned is that they are tackling the remaining cases where C++ can outcompete Java for things like media codecs. And the Java world has developed a JVM written in Java, actually several of them, so whilst Google hasn't done it, the tech is actually there. All this exists today, whereas an entire widely adopted consumer OS written fully in Rust is only a pipe dream. Oh, and as for drivers, Google moved drivers out of the kernel and into user space some time ago (Project Treble): https://source.android.com/devices/architecture https://source.android.com/devices/architecture You can in fact now write drivers in Java. Google recommend you don't, but it's architecturally possible: https://source.android.com/devices/architecture/hidl-java https://source.android.com/devices/architecture/hidl-java

imdoor 5y ago

> Fixing the hardware, which is to say surgically removing the two or three tiny microphones hidden inside, is only the first step of an arduous process, and yet even after days of these DIY security improvements, my smartphone will remain the most dangerous item I possess. What's the purpose of these microphones? Do they pose more threat than the standard non-hidden microphone?

z77dj3kl 5y ago
I think he's referring to the standard, non-hidden microphones.
aaronmdjones 5y ago
I believe he's referring to the various MEMS sensors (accelerometer, gyroscope, etc) which can be repurposed into microphones (much like harddrives).
olabyne 5y ago
These are the "standard microphones" of any modern smartphone. One microphone at the bottom, for calls, and 1 or 2 at the top, for stereo sound while recording videos and noise cancelling while doing call

dxuh 5y ago

Everyone in these comments mentions C and C++ as a single word, which frankly has nothing to do with reality. C++ is a FAR safer language than C, if you wish to use it properly (which many don't). I write C++ full time at work and I also use it a lot in my free time and I rarely if ever have out of bounds accesses, use after free or any of these bullshit errors. If you use modern C++ and AdressSanitizer and don't do anything too "fancy" then it's very hard to get those types of bugs. I firmly associate them with C and C alone. These time are over for modern C++. The people commenting here clearly have no idea what modern C++ even looks like.

hawski 5y ago
As much as like C and dislike C++ you are right.
eandre 5y ago
The problem for modern C++ is that few (or zero?) code bases contain exclusively "modern C++" when you include all transitive dependencies. You end up using a huge amount of C and "legacy C++" just by virtue of reusing code.
- snovv_crash 5y ago
  This is true for Rust as well though.
pjmlp 5y ago
Because even companies like Microsoft and Google don't write modern C++, you can easily validate this on their public repositories. See how much modern C++ you will find in AOSP and NDK, WinUI or XBox code samples. Modern C++ exists only at talks in CppCon, C++Now.
x4e 5y ago
C++ can be safer but that does not mean it is safe. The fact you have out of bounds accesses, even if it is rare, is not really acceptable in a language that would like to be considered “safe”.

n0on3 5y ago

I think we already know how to build secure tech, we just don't because of the cost, which is not 2x or 10x but way higher to the point that is deemed not worth/feasible both for private companies and governments, so it affects everyone and we are not getting out of it anytime soon (if anything sometimes we go in the opposite direction following the goal of money and calling it innovation). Heck, I think it would take a book just to even explain all the components of this argument. Go figure do something meaningful about it. Safe/unsafe languages is just one piece of this thing, and frankly a quite easy one to wrap one's head around: we already have so much stuff we use everywhere written when memory-safety was not really cared for and no-one wants to rewrite / catch up / surpass (there you go: because of the cost). So we get on with it, because meanwhile life goes on, bread needs to put on the table, people want to play with their shiny phones and whatnot, etc.

pjmlp 5y ago

"If you want to see change, you need to incentivize change. For example, if you want to see Microsoft have a heart attack, talk about the idea of defining legal liability for bad code in a commercial product. If you want to give Facebook nightmares, talk about the idea of making it legally liable for any and all leaks of our personal records that a jury can be persuaded were unnecessarily collected. Imagine how quickly Mark Zuckerberg would start smashing the delete key. Where there is no liability, there is no accountability... and this brings us to the State. " Yep, this definitly needs to eventually happen.

kragen 5y ago
If this happens, it will be the end of open source and the indie web. Only large companies with large legal departments and serious liability insurance, and anonymous underground hackers, will be able to afford to make software public for commercial use or run a website.
- grncdr 5y ago
  How would this make running a personal website risky from a legal liability perspective?
  - kragen 5y ago
    Are your HTTPD logs adequately secured? Are their security measures audited monthly, in keeping with established industry best practices? Do you have comments enabled on your blog? What's your policy for expunging blog posts about people exercising their right to erasure? How did this defamatory comment spam get past your comment filter? Did you know your open-source image thumbnailing software is being used on an illegal pornography site? Why didn't your legal office respond within 8 hours when you were notified of a privacy invasion on your blog last Saturday?
    - grncdr 5y ago
      What a load of FUD. Personal websites don't need anything more complicated than an out-of-the-box config for apache or nginx to serve static files out of webroot. When's the last time that kind of setup was exploited? Sure if you add more complexity, you add more attack vectors, but there's an easy way to reduce your legal culpability there: just don't collect any PII. Even in the scenario you propose where anonymous HTTPD logs are a liability (which... yeah, is not going to happen any time soon) the solution is simple: turn off logging. If the legal precedent is established, the defaults of our software will change to match.

Synaesthesia 5y ago

The problem is bigger than hardware and software being "insecure" it's got ultimately to do with trust of these corporations. Do we trust that Apple, Google and so on will do the right thing? If not maybe we can construct new (maybe public) companies which are accountable for our privacy. Or hold existing companies accountable. Its going to need a huge swing of power towards ordinary people though.

minusSeven 5y ago

Do people really think any of this is ever going to change? Governments don't give a shit, they time and again say they won't do something only to later do it in secret. We should at this point accept that this isn't going to change and move ahead with the belief that your data is already hacked and is not private anymore. We should discuss more on the exact consequences of this and take actions accordingly.

Synaesthesia 5y ago
So not point in ever doing anything? Just give up. A mass movement of people can force a government to change.
- deleted 5y ago
  [deleted]
- minusSeven 5y ago
  Do people stop doing crimes because laws have made it illegal. I am saying there is no point trying to stop what is inevitable instead our energies are better spent trying to understand how best to navigate an online world without any privacy. Right now many western nations are involved in Pegasuses, what happens when China gets involved. We will have absolutely no control over what China does, especially when no country will publicly acknowledge that we are spying on people.
deleted 5y ago
[deleted]

joelbondurant 5y ago

Queue the smarmy communists to discuss the holy religion of bully state solutions.

m12k 5y ago

Are there any compelling reasons why it should be legal to sell exploits to anyone other than the company whose software is vulnerable? By neatly bundling these exploits up and selling the hacking tool to the highest bidder, this company is giving nation-state spying capabilities to cartels and dictators who would otherwise not have had that. I don't see why that shouldn't be regulated the same way as if they were selling nukes.

yabones 5y ago
It's even more insane when you remember that strong encryption was regulated as munitions until the mid 90s [1,2] - and actual cyber-weapons aren't today. Software that can cause real damage to not just data and business activities, but endanger lives is completely legal to sell to despotic lunatics. If you sold a bag of fertilizer to a Syrian you'd go straight to Guantanamo, but somehow this is okay. [1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [2] https://web.archive.org/web/20051201184530/http://www.cyberlaw.com/cylw1095.html https://web.archive.org/web/20051201184530/http://www.cyberl...
tim333 5y ago
Laws are made by the government of the country in question and in this case the government, Israel, approved the sales and used them to its advantage.
aj3 5y ago
LEO and TLA need vendors with constant supply of exploits.
red_trumpet 5y ago
Iirc the software sold by the NSO group is considered a weapon under Israel law, so it is somewhat regulated. Not as heavily as nukes though. This begs the question: Is there a compelling reason why selling weapons to other states should be legal?
- iFreilicht 5y ago

mark_l_watson 5y ago

Great article that I am sharing with non-tech friends and family. The most powerful point is to stop using unsafe programming languages. I usually use Common Lisp (for almost 40 years now), but I have been experimenting a lot with Swift over the last year. I have little experience with Rust. I have seen comments that Swift and/or Rust are not appropriate for operating systems and general systems programming, but I call bullshit on that. The problem is a financial problem, expensive to pay for difficult to hire Rust and Swift developers to rewrite billions of lines of code. But it should be done. I pay an incredible amount of money to Apple every year and I expect it from them. Same for Microsoft customers (and Google).

bob1029 5y ago

> The greatest danger to national security has become the companies that claim to protect it No. The greatest danger is lack of software supply chain management followed by near-universal disrespect for formal complexity management methods. The only way I have found to win at this "are we actually secure" game is to minimize the number of parties you have to trust. The smaller you get this figure, the easier it becomes to gain control over your circumstances again. How many of us can immediately state the exact number of unique parties that we have to trust as part of building solutions for other people? What about complexity? Most of the time, something is insecure not because of malicious intent (covered by the trust angle above), but because its so goddamn complex that no one can say for sure if its correct or not. Why do we tolerate this?

ncmncm 5y ago
There is no supply-chain accountability without liability. When adding a dependency, knowing it exposes you to prosecution if it becomes a vector for security violation would give pause. A premium on attested-secure components might develop. If Facebook depended on Zst being secure to be able to stay in business, we might be more inclined to use Zst than e.g. unmaintained Zlib.
- ryandrake 5y ago
  Coming from embedded/avionics, it's shocking how careless and cavalier the rest of the development industry is about their dependencies. At most places, outside large FAANGs that bake external dependency reviews into their process, the process is: 1. Developer has a problem to solve 2. Developer does a few web searches and finds libXyz, which looks like it solves the problem. 3. Developer tries libXyz and it solves the problem. 4. Yolo! A libXyz dependency is added, and now it's part of the product that the company stakes its name and reputation on. Total madness. What else does libXyz do? What data does it collect? What does it do with that data? What bugs does libXyz have, and do they put our product at risk? What about security risks? Does libXyz have tests, and do they pass? How extensive is its test coverage, and would that be sufficient at our company? Does libXyz impact the overall performance of our product? What is its maximum memory footprint? Does libXyz limit our product to a particular architecture? What is libXyz's license, and is it compatible with our product? Who is responsible if libXyz fails and our company gets sued? You're lucky if the developer even thinks about one or two of these, let alone fully auditing the library. Staking your product on the suitability of a library but not actually thoroughly vetting the library. And some products out there have hundreds of dependencies, all added in the manner described above. We're just handing out loaded guns.

raman162 5y ago

I definitely agree with Snowden's call to action with making spyware illegal, I think the execution is plausible but unlikely for the same reasons he stated in the article. Every country is working to produce these things themselves for cyber security self defense. I am unsure about his comments regarding unsafe code. Like many of the people have already stated here, that's a blurry line that has good intention but seems nearly impossible. I think more regulation and certification for both employees and companies is a much more likely to be successful.

rsanek 5y ago

>If hacking is not illegal when we do it, then it will not be illegal when they do it—and “they” is increasingly becoming the private sector. Not sure I follow the logic here. The State has a monopoly on many things that are never allowed in the private sector -- violence being the most obvious one. We don't seem to have a huge problem with the split here; why we couldn't do the same for hacking?