3 ms·

>Cybersecurity is a lost cause. We just can't fix it. It's not... it just seems like it because our current way of using computers seems to make sense, when ac

>Cybersecurity is a lost cause. We just can't fix it. It's not... it just seems like it because our current way of using computers seems to make sense, when actually it's insane. If we thought of money the same was as compute, image going to buy bread at the store. You make your selection, then hand over your wallet, and sign a power of attorney, have it notarized, and hand it to the clerk. This clerk has been checked to me a good clerk by both your AntiBadClerk service. You get your wallet back, and take your purchase home, confident it has had no bad side effects, and the correct amount has been taken from your wallet. --- Or... you could take $5 from your wallet, and hand it to the cashier, very confident there can't be any larger side effect than the loss of the $5. --- We use the principle of least privilege when we take money from our wallet to pay in a transaction. The largest side effect possible in a normal transaction is not getting the correct change back. --- We use the principle of "don't trust the user, blindly trust the software with the user's rights" with our programs on computers. We hope that our firewalls and antivirus have stopped anything bad from happening. Unfortunately the halting problem is impossible to solve, and you can't enumerate bad software, or limit side effects using this model. --- Every time I bring this up here, objections are made that it's too complicated, wouldn't actually work, etc... Fine, I expect those, and will try to answer them, like always. My main point is, least privilege works. WASM seems to be holding up fine, and it uses it. Virtual Machines and Containers are a way too course model of it. Cybersecurity CAN be solved. Please don't give up hope.

nonrandomstring 5y ago
> Cybersecurity CAN be solved. Please don't give up hope. Thank god there are people like you who still have the courage to think this way. My comment "Cybersecurity is doooomed" is actually a little more nuanced. Here's a few of the issues, as I see it, in a longer form [1]. Pragmatically, what we now have is a culture aggressively opposed to the USERS's security [2] under the various veils of "convenience", "necessary efficiency" and "security". Yes, included in these "three-little-pigs of broken systems" faux "security" is also key mechanism for undermining _actual_ security). To this end, grotesque negligence and incompetence are rewarded in the name of shipping products, making money, satiating power and exalting convenience uber-alles. To take your analogy of money. Quite literally the opposite is being pushed under the guise of "cashless commerce". Instead of taking $5 from your wallet, you wave a contactless card at an unknown computer and hope it's "temporary power of attorney over your bank account" works out fairly. Yes, cybersecurity can exist. But I don't think it can exist in the digital ecosystem that corporations and governments want to push onto society. [1] http://techrights.org/2021/11/29/teaching-cybersecurity/ http://techrights.org/2021/11/29/teaching-cybersecurity/ [2] I believe, and teach my students, that in the adversarial 21st century context of unfettered state security and surveillance capitalism security is a "fixed sum game". For example, the vendor's security is the user's insecurity, and so on. Any question of security must be qualified with three further questions: Security for who? Security from who? Security to what end?
- mikewarot 5y ago
  I read your essay... how rare am I, really? Security for the owner of the computer. A tool for that user, the person you daily uses it in their lives. Not some corporation or government. Security from everyone who is not the owner, and especially NOT any code, from anyone one, anywhere. Users should NEVER have to blindly trust code. They should ALWAYS have a way to play with code, and know it won't have any unwanted side effects, ever. Security to what end? It's a tool, man. Think of the care free days of CP/M and MS-DOS, when you could get shareware disks full of nifty stuff to try out, and you could write programs to do anything you wanted, and share them with the world. You write-protected your OS, and could try anything, and see how you liked it, in safety. That power, in the hands of the people, is the end I seek.

nonrandomstring 5y ago

> Cybersecurity CAN be solved. Please don't give up hope. Thank god there are people like you who still have the courage to think this way. My comment "Cybersecurity is doooomed" is actually a little more nuanced. Here's a few of the issues, as I see it, in a longer form [1]. Pragmatically, what we now have is a culture aggressively opposed to the USERS's security [2] under the various veils of "convenience", "necessary efficiency" and "security". Yes, included in these "three-little-pigs of broken systems" faux "security" is also key mechanism for undermining _actual_ security). To this end, grotesque negligence and incompetence are rewarded in the name of shipping products, making money, satiating power and exalting convenience uber-alles. To take your analogy of money. Quite literally the opposite is being pushed under the guise of "cashless commerce". Instead of taking $5 from your wallet, you wave a contactless card at an unknown computer and hope it's "temporary power of attorney over your bank account" works out fairly. Yes, cybersecurity can exist. But I don't think it can exist in the digital ecosystem that corporations and governments want to push onto society. [1] http://techrights.org/2021/11/29/teaching-cybersecurity/ http://techrights.org/2021/11/29/teaching-cybersecurity/ [2] I believe, and teach my students, that in the adversarial 21st century context of unfettered state security and surveillance capitalism security is a "fixed sum game". For example, the vendor's security is the user's insecurity, and so on. Any question of security must be qualified with three further questions: Security for who? Security from who? Security to what end?

mikewarot 5y ago
I read your essay... how rare am I, really? Security for the owner of the computer. A tool for that user, the person you daily uses it in their lives. Not some corporation or government. Security from everyone who is not the owner, and especially NOT any code, from anyone one, anywhere. Users should NEVER have to blindly trust code. They should ALWAYS have a way to play with code, and know it won't have any unwanted side effects, ever. Security to what end? It's a tool, man. Think of the care free days of CP/M and MS-DOS, when you could get shareware disks full of nifty stuff to try out, and you could write programs to do anything you wanted, and share them with the world. You write-protected your OS, and could try anything, and see how you liked it, in safety. That power, in the hands of the people, is the end I seek.