3 ms·

> The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated Our field is in denial about the i

> The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated Our field is in denial about the importance of diversity to security. Biologists have no problem understanding this. Why can't we?

solarengineer 5y ago
Could you elaborate? I myself can only guess at what you mean by "diversity to security". I can think of: 1. Develop software in the open. 2. Teach security and cryptography widely using openly-developed syllabus. 3. Encourage parallel initiatives. I don't think you are referring to racial or gender or cultural diversity.
- dolgo 5y ago
  I assume they were referring to diversity of cell phones/mobile OSes, rather than the duopoly of Android and iOS.
simonh 5y ago
It’s not immediately obvious to me that diversity is better. A chain is only as strong as it’s weakest link. If a foreign state has access to two phones with a secret on it and each has a different OS with different vulnerabilities, that just gives them a bigger attack surface. Similarly if there are 5 sophisticated attackers after your secrets, some may have cracked your phone security, but not others. If you use more different phone OSes you increase the chance that more attackers have exploits for at least some of your phones. Also using more phone types complicates training, increases the work you must do checking for vulnerabilities, diluting your efforts.
- trembonator 5y ago
- est31 5y ago
  It gets different when you are talking about denial of service attacks. Imagine everyone drove cars from the same brand, and one day a hacker discovers a way to make them all stop. Then society is shut down. If 20% of cars stopped working, it's still a major catastrophy but you can work around it somehow. If you have robot armies or something it gets even more dangerous to put all your eggs into one vendor basket.
- hamilyon2 5y ago
  You are implying that phone models for top officials are chosen at random. Better diversity would also mean more choices, which mean some devices are more tailored to needs of a certain type of consumers, like business and government ones. They get less gifs to send, but have their software developed by paranoid people and "do not leak any secrets ever", and "no rce" are their first and only sprint goals. So basically, now choice is between bad alternative and the even worse one. Asking for more choices is an important proposition, I'd say
adrianN 5y ago
Evolution has the benefit that it can develop in parallel. We only have limited manpower for our creations, so it's entirely possible that focusing our efforts produces better results.
- octoberfranklin 5y ago
  Nature has limited free energy for its creations. Besides, tens of thousands of separate software companies can easily develop in parallel. There's only a bottleneck when you assume that this stuff has to come from a BigTech giant. The same mistake people made with PCs and Windows in the 1990s.
fsflover 5y ago
>Our field is in denial about the importance of diversity to security. https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

solarengineer 5y ago

Could you elaborate? I myself can only guess at what you mean by "diversity to security". I can think of: 1. Develop software in the open. 2. Teach security and cryptography widely using openly-developed syllabus. 3. Encourage parallel initiatives. I don't think you are referring to racial or gender or cultural diversity.

dolgo 5y ago
I assume they were referring to diversity of cell phones/mobile OSes, rather than the duopoly of Android and iOS.

simonh 5y ago

It’s not immediately obvious to me that diversity is better. A chain is only as strong as it’s weakest link. If a foreign state has access to two phones with a secret on it and each has a different OS with different vulnerabilities, that just gives them a bigger attack surface. Similarly if there are 5 sophisticated attackers after your secrets, some may have cracked your phone security, but not others. If you use more different phone OSes you increase the chance that more attackers have exploits for at least some of your phones. Also using more phone types complicates training, increases the work you must do checking for vulnerabilities, diluting your efforts.

trembonator 5y ago
est31 5y ago
It gets different when you are talking about denial of service attacks. Imagine everyone drove cars from the same brand, and one day a hacker discovers a way to make them all stop. Then society is shut down. If 20% of cars stopped working, it's still a major catastrophy but you can work around it somehow. If you have robot armies or something it gets even more dangerous to put all your eggs into one vendor basket.
hamilyon2 5y ago
You are implying that phone models for top officials are chosen at random. Better diversity would also mean more choices, which mean some devices are more tailored to needs of a certain type of consumers, like business and government ones. They get less gifs to send, but have their software developed by paranoid people and "do not leak any secrets ever", and "no rce" are their first and only sprint goals. So basically, now choice is between bad alternative and the even worse one. Asking for more choices is an important proposition, I'd say

adrianN 5y ago

Evolution has the benefit that it can develop in parallel. We only have limited manpower for our creations, so it's entirely possible that focusing our efforts produces better results.

octoberfranklin 5y ago
Nature has limited free energy for its creations. Besides, tens of thousands of separate software companies can easily develop in parallel. There's only a bottleneck when you assume that this stuff has to come from a BigTech giant. The same mistake people made with PCs and Windows in the 1990s.

fsflover 5y ago

>Our field is in denial about the importance of diversity to security. https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)