4 ms·
It's a fundamental and systemic problem. We have a ton of software written in unsafe languages (C and C++). Our operating systems, web browsers, email readers,
by _wldu 5y ago
It's a fundamental and systemic problem.
We have a ton of software written in unsafe languages (C and C++). Our operating systems, web browsers, email readers, file editors, etc. Our governments and cyber-criminals have stock-piled 0-day exploits against these unsafe systems. They have hundreds or maybe thousands of these exploits.
On top of that businesses want features added to user-facing apps as fast as possible (beat the competition). These apps sit atop the unsafe C operating systems and often times run as root or Administrator. These apps have many logic flaws. Governments and criminals have stocked-piled 0 days against these flaws as well.
So until our systems and apps are re-written in safe languages (Go, Rust, C#. Java) and most processes run in an un-privileged context and mandatory access control (MAC) is applied to all running processes (all the time), we will continue to be hacked in ever-growing catastrophic ways.
IMO, this may be the explanation to the Fermi paradox. The aliens did themselves in with insecure software.
- Natsu 5y agoHow many of those mitigations would've solved the log4j misfeature? It was in Java, there is an access control to turn off JNDI lookups (that was off for some stupid reason), etc.
- _wldu 5y agoA MAC in enforcing mode would have prevented it.
- mikewarot 5y ago>We have a ton of software written in unsafe languages (C and C++). That's one of the favorite stances to take here on HN, and is driving the adoption of .NET, Go, Rust, etc (as far as I, a mere Pascal programmer, can tell) It is not, however the root cause of our cybersecurity woes. It's ignoring the principle of least privilege at all levels, especially that of the OS kernel. Instead of trying to rewrite everything in a "perfect" language, it would be far wiser to redirect some of this effort towards adopting a microkernel/capability based OS such as Genode, Fuchsia, etc, there's a handy list at https://en.wikipedia.org/wiki/Capability-based_operating_system https://en.wikipedia.org/wiki/Capability-based_operating_sys...