5 ms·
They just so happen to see a lot of challenges that their software is well suited to resolve... no surprises there. My predictions for 2022: An awful lot of wo
by Syonyk 5y ago
They just so happen to see a lot of challenges that their software is well suited to resolve... no surprises there.
My predictions for 2022: An awful lot of work to be had before you go insane.
I'd expect the trends of "massive complexity causing problems solved by more complexity" to continue, because that's literally the only thing the hardware and software industry seems capable of doing anymore. Stacks of complexity that then require more complex hardware to run, and the cycle continues. Nobody understands the whole stack anymore, except perhaps the malware authors who freely move up and down the stack to accomplish their goals. Those writing the software and, theoretically, auditing the software don't seem capable of finding badness hidden in it - and decades of experience says, "Humans can't find suitably stealthy badness hidden in software, intentional or not." Look at how long some of the really nasty bugs have been floating around (exploited or not, we don't know) before someone finally got around to noticing them. I mean, how long was Debian only generating one of 32k SSH keys?
I don't see a good path forward for "connected, computer based, all the things." If we were willing to consider dumping, say, 80% of the features of modern computing, we could probably do a pretty good job securing the other 20% (the commonly used ones). But at too many places, payment and promotion is for features, not bugfixes, not security patches. So new features just keep getting released, old stuff gets abandoned, and the cycle of promotion goes on. The incentives are simply wrong to create anything faintly resembling secure software.
And I expect a continuing wave of people who've been doing security for 20-30 years just... quietly retiring to a life of not much consumer tech. The joke in my circles is that we'll be goat or llama farmers, and I'm not sure it's too far from the truth. I expect a large collection, in decades to come, of "You clearly enjoy this farming thing, I don't think you care a bit about making money, and why is the most advanced bit of technology on this place a couple Arduinos?" You'll find them run by former low level security types.
I don't know how much runway is left in the current trends of tech, consumer and enterprise, but we're clearly at a point where nobody can reason about the stuff anymore, and even if you're using all the patches, all the best practices... you can still have your whole company shut down by ransomware and such. It's less likely, but still far from impossible, when we see things like former NSA 0days used to deploy ransomware. Pretty hard to defend against 0days.
Were I to do a business these days, I'd probably take a serious look at doing things like "Training employees on Qubes" (and buying hardware that can run it). You may not be able to make things impossible for an attacker, but you can sure make them want to go somewhere else for easier pickings (if they're not targeting you, specifically - if they are, you're probably screwed). The whole "Giant Windows Domain" thing repeatedly proves impossible to secure in practice.
Or maybe just go back to typewriters and a good secretary or two.
- phyalow 5y agoVery thoughtful comment thanks. >>Or maybe just go back to typewriters and a good secretary or two. https://www.theguardian.com/world/2013/jul/11/russia-reverts-paper-nsa-leaks https://www.theguardian.com/world/2013/jul/11/russia-reverts...
- GekkePrutser 5y agoI wonder if they still use them though. You quickly get to a point of the security measures undermining effectiveness.
- mrweasel 5y agoThank you, I wouldn’t say I enjoyed it, because that is a dark future you’re painting. The point on complexity is spot on with the trends I’m seeing. Simple projects are increasingly solved by systems growing in layers and complexity, all in the name of making things easier to the developers that sits at the tips of the complexity and does see the horrors of the lower layers, and to pump out a ever growing bundle of features that shouldn’t be. We write more and more code, to avoid changing broken procedures. A broken world is painted over with shiny code, which few truly understand, all because we don’t want to fix the underlying problems.
- Syonyk 5y ago> ... because that is a dark future you’re painting. I'd argue, but I can't... When a basic "cross platform application" now has 1-1.5GB of build directory for all the 50,000 nested Node dependencies that allow you to not have to write your own left pad, you can't know what most of the code is. It's simply not possible. Windows 95 was about 50MB installed. A modern chat client is a couple hundred meg, because it's a web app, carrying it's own browser around, running in Javascript, and... etc. A quad core 1.5GHz CPU will struggle with it (source: I run Rpi4s for desktops and Element really, really tends to lag on text input if you type fast). I don't see how it gets better when these are the trends. New frameworks, new libraries, new UI toolkits, more complexity, less understanding, and ever new and shiny security bugs. But those bugs aren't a problem, because nobody is punished for them. Whoopsie daisy, giggle, my logging function allows for remote code execution! I'm not saying that individuals should be jailed for bad code, but if you're a company and you ship a product, "Oh, well, that open source part we used was bad..." shouldn't be a good excuse for why someone with your product installed can be pwned from across the internet. Yes, that implies lower complexity of software, and, yes, that's my exact point. I use a computer in 2021 for a lot of the same stuff I used a computer for in 1997. Writing documents, writing code, chatting with people, visiting websites, sharing photos, editing photos, etc. The difference is that now I need a 6-core processor and 32GB of RAM to do it sanely, when I could do roughly the same stuff in 1997 on about 32MB of RAM and a single processor, running at sub-100MHz. I don't see a good path forward regarding computer security, which is part of why I've been starting to use computers less and less, and finding other ways to accomplish things that aren't internet-vulnerable-to-everything. I just don't see a way out when all the incentives are wrong.