5 ms·

> This attitude is cancer > yes really - fucking always You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked

> This attitude is cancer > yes really - fucking always You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible security gap and compromised usability". Be charitable in your interpretation. Your OP is making a simple argument that defense in depth is a part of a security posture, precisely because they agree with your core premise, that security is always a tradeoff. Because we won't choose to implement every security measure, and because the security measures we do implement will be flawed, or compromised by the need for the application to actually be usable. Step outside, breathe some fresh air, maybe lay off the coffee first thing. And consider not throwing 'cancer' bombs at passers-by.

generalizations 3y ago
The point is that it's a really bad tradeoff, because the impact to the users is high, and the impact to security is low. And yet we do it, because "You don't stop securing it just because you've found one good option", and that's a really bad reason to improve security by such a small increment with such large negative consequences. The problem with 'defense in depth' is that it comes as close as possible to locking down systems to the point of uselessness, without actually, technically, preventing work from being done.
- horsawlarway 3y ago
  Ding ding ding! If you want to defend in depth - more power to you. If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. If you blindly say "defend in depth" without actually... you know... evaluating what that defense does to the product as a whole, you're doing your job poorly.
  - jameshart 3y ago
    The rules of engagement on this site call not for radical candor but for taking the most charitable interpretation of someone's words. Maybe the OP wasn't blindly saying 'defend in depth'? Maybe they were advocating for evaluating what that defense does to the product as a whole? If they were, is their attitude worth describing as cancerous?
    - horsawlarway 3y ago
      If that was my entire comment - I'd probably agree with you. Good thing there's about 5 other paragraphs of content in my response that provide additional context... My take: you're stuck on the word cancer as some sort of insult, rather than an analogy. I'd argue you're being fairly uncharitable in your responses - and further... you're yet again not engaging with the actual on-topic discussion. Have a good one.
  - lelanthran 3y ago
    > Ding ding ding! > If you want to defend in depth - more power to you. > If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. Agreed. Sure, there is defense at different depths, but there's no reason to add depth without adding defense as well.
- jameshart 3y ago
  That's a reasonable point, sure. One which can be made reasonably, without telling anyone that their attitude is cancerous.
  - horsawlarway 3y ago
    I don't think that appealing to courtesy is really the play here. We are discussing ideas about security in a place and manner that allows us to have honest and frank conversations. I think security teams optimizing only for security is actually very apt analogy to cancer: Part of the organization is acting in a manner that is negatively impacting the organization at large - while positively impacting that subset of the organization. Cancer is the act of some cells in your body prioritizing themselves at the expense of the whole. Personally - I think you're digging to find an insult in that comment, and I take it as a way for you to disengage with the topic at large. This is an attitude that is routinely used to shut out voices that don't match the current "dress code". Trust me, I'm hardly going to be calling you cancer over the dinner table for not passing the salt. I'm using that word intentionally and carefully - in a frank and honest conversation. If you're feeling hurt (especially on behalf of someone else...) maybe go do something else?
- _jal 3y ago
  > The problem with 'defense in depth' No, that's a problem with bad engineering. That a process requires skills most people attempting it don't have isn't a problem with the process, it just means that it is hard and relatively new. One thing I see all the time that demonstrates this incompetence is talking about something being more or less "secure" without reference to a threat model. You simply can't make reasonable tradeoffs without thinking this through, and yet nobody wants to do the exercise. In fairness, this is not just an engineering fault. I've seen one case where a legal department freaked out when they heard about a risk analysis project in pursuit of a formal threat model - they vehemently objected to anyone producing documents about such things that could potentially surface in some discovery fight.
  - horsawlarway 3y ago
    > One thing I see all the time that demonstrates this incompetence is talking about something being more or less "secure" without reference to a threat model. You simply can't make reasonable tradeoffs without thinking this through, and yet nobody wants to do the exercise. Hey - I completely 100% agree. Believe it or not, I did quite a stint in software security before becoming this jaded (5+ years fulltime work at a security focused product sold primarily to large fortune 100 companies [banks - it was all banks]). I think my problem is that for any difficult challenge... there is an answer that is simple, obvious, and incorrect. My opinion is that the incorrect answers I see most are the two extremes: I don't care about security (BAD!). I only care about security (WORSE!!!!). The first will eventually lead to compromised accounts/data and that can kill a company. The second will lead to products no one wants to use, which WILL kill a company. Neither is a good spot to be. You want to find an appropriate compromise in the middle: Secure enough. ---- Side note - no one truly does the threat assessments based on threat model because no one in industry likes the answers. For small and inconsequential threats - you are already secure enough. For nation states - there is likely no solution that is workable if the thing is on the internet. It's like trying to buy a secure door for your house: For most folks walking down the street, the current door is fine. When the Gov shows up with tanks - there is no door you can buy to solve the problem.
  - deleted 3y ago
    [deleted]
- oceanplexian 3y ago
  The other thing security people fail to realize is that when you’re hostile to UX, people start coming up with all sorts of workarounds that leave you less secure than you were before. Like the corporate managed laptop is so full of spyware that users bypass it and use their own personal device for development.
  - vuln 3y ago
    We don’t fail to realize that. Security folks are humans too. We realize that every human loves convenience and security removes conveniences. Simple As. No matter what we do as security folks, the users will do everything possible to return to their convenience or complain about the inconvenience until the security is removed. I’m not saying there aren’t over zealous security folk but our goal isn’t to make humans lives harder. We want to make it harder for the bad guys to ruin humans lives.
    - generalizations 3y ago
      > human loves convenience Except that it's not a matter of 'convenience', it's a matter of being able to do their jobs. Security is a hard job, in part because you have to come up with security practices that are actually workable, and keep work impediments to a minimum. It's really easy to just add more restrictions. It's hard to add security that doesn't impede the users. When I see 'defense in depth' being invoked to justify massive work impediments for minimal security improvements, I don't see effective security practices - I see a cargo cult.
    - imachine1980_ 3y ago
      not your objective is make the organización loss the less money posible by reducing the incident rate the recovery rate or the impact if you damage the org more the risk you are saving against you are liability, this isn't good vs bad thing, this is decide when the line is worth crossing and this article say at least in their opinion this open isn't, you still have multiple other layers.
horsawlarway 3y ago
> You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? You are - you're literally arguing for it right now. Short sessions just don't help all that much, and they have an outsized impact on users. Why are you dying on this hill? Likely because your mindset is "security above all else" and that mindset is literally cancer. Security above all else leads to a product that does fuck-all else (and it does it poorly).
- lambic 3y ago
  Literally cancer? Really?
  - horsawlarway 3y ago
    Yes. Literally. I would say it makes an excellent analogy: A part of the whole (security) is prioritizing themselves and their needs in a way that makes the overall organism much less capable and effective. Cancer.
    - recursive 3y ago
      Still metaphorical cancer.
      - horsawlarway 3y ago
        Not according to the definitions of those words that I can see Metaphor: a figure of speech in which a word or phrase is applied to an object or action to which it is not literally applicable. Cancer: a practice or phenomenon perceived to be evil or destructive and hard to contain or eradicate. My usage is literal. Organizations that act this way have cancer. They suffer from it, they can be treated, they can die. It's as real as it gets. I am using cancer in the body as an analogy for this form of cancer - but I am not using a metaphor.
  - paulddraper 3y ago
pxc 3y ago
> Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible security gap and compromised usability". It seems to me that 'defense-in-depth' can very easily become a mantra that inevitably means drifting towards the latter. What are the real guidelines for telling when enough is enough? Because ime people who even can articulate anything along those lines are way, way fewer than people who make appeals to defense-in-depth. And I think this is part of the problem: without a principled way to assess what is gratuitous, repeated appeals to defense-in-depth will lead to security practices that heavily favor having more measures in place over having a good UX. This is because the environments where information security is most valued are already organizations that frankly, do not give a shit about UX. The customers for cybersecurity products are massive bureaucracies: large enterprises, governments, and militaries. The vendors that sell those products are embedded in a broader market where no software really has to be usable, because there's a fundamental disconnect between the purchasing decision and the use of the software. For all B2B software, the user is not the customer, and it shows in a thousand ways. In infosec things are further tilted in that lots of easy routes to compliance which are terrible for UX are falsely perceived and presented as strictly required, perhaps even by law. The idea that in a B2B market which primarily serves large organizations and governments, you will get any organic weighing and balancing of security against usability 'for free' is sheer fantasy. So where is the real counterweight to the advice that on its own recommends 'always add more, unless you have good reason not to'?
- horsawlarway 3y ago
  I think this is a more elegantly stated version of my argument. It's also why I strongly link this argument to cancer. It's an idea that grows unbounded until it's harmful, and by the time the organization realizes the harm, it's often too late to change.
  - pxc 3y ago
    > I think this is a more elegantly stated version of my argument. Yep. I think your argument pretty much conveyed the same thing, along with a lot of anger and frustration. I also agree with that anger and frustration— I've felt the same rage before, when I've been hit with blockers or UX degradation related to nominal or actual attempts to improve security. Restrictions that are ill-motivated (or whose motivations are just not clearly or convincingly communicated) are infuriating. > by the time the organization realizes the harm, it's often too late to change. This worry is the twin of the rage, for me, this sense that I can't do anything about it and it's never going to get better. A dreadful, reluctant admission to myself that the only way to stop the continual degradation of my work life will be to uproot myself: give up my job and everything I do like about it, leaving behind people I enjoy working with and reducing the amount of contact I have with them. Happily, engaging directly with my company's infosec department directly often gives me hope and allays these fears somewhat. But generally, online discussion with people who implement security controls tends to reinforce my worry that, to borrow your metaphor, the disease is systemic and terminal. Most 'cybersecurity professionals' (who are visible online, at least) transparently do not give a shit about UX, display flagrantly antagonistic attitudes about users and developers, and talk often about defense-in-depth but never articulate any inherent limits for appeals to defense-in-depth beyond 'well don't bother with measures that don't increase security at all'. All of it sends strong signals that people who value UX, DX, autonomy, morale, and well-being, to the extent they are present at all, are outliers in infosec who do not belong and have no hope of being effective. And then the response to someone openly including a dimension of emotionality in an argument about a security measure they feel is gratuitous and cumbersome is > Did... did [a cumbersome security measure] hurt you? Like, seriously? Yes. Indeed it did and does. But more than the security measures themselves, the pervasive attitude conveyed by that belittling question is the even bigger problem. And it generates many of the small ones.
dang 3y ago
Please don't cross into personal attack, no matter how bad another comment was or you feel it was. It only makes things worse. (I appreciate that you're arguing for charitable interpretation, but the personal swipes at the beginning and end of your post wipe out the good effect and then some.) https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

generalizations 3y ago

The point is that it's a really bad tradeoff, because the impact to the users is high, and the impact to security is low. And yet we do it, because "You don't stop securing it just because you've found one good option", and that's a really bad reason to improve security by such a small increment with such large negative consequences. The problem with 'defense in depth' is that it comes as close as possible to locking down systems to the point of uselessness, without actually, technically, preventing work from being done.

horsawlarway 3y ago
Ding ding ding! If you want to defend in depth - more power to you. If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. If you blindly say "defend in depth" without actually... you know... evaluating what that defense does to the product as a whole, you're doing your job poorly.
- jameshart 3y ago
  The rules of engagement on this site call not for radical candor but for taking the most charitable interpretation of someone's words. Maybe the OP wasn't blindly saying 'defend in depth'? Maybe they were advocating for evaluating what that defense does to the product as a whole? If they were, is their attitude worth describing as cancerous?
  - horsawlarway 3y ago
    If that was my entire comment - I'd probably agree with you. Good thing there's about 5 other paragraphs of content in my response that provide additional context... My take: you're stuck on the word cancer as some sort of insult, rather than an analogy. I'd argue you're being fairly uncharitable in your responses - and further... you're yet again not engaging with the actual on-topic discussion. Have a good one.
- lelanthran 3y ago
  > Ding ding ding! > If you want to defend in depth - more power to you. > If the way you're "defending in depth" is mostly not adding security, and is actively making the product less useful... I'm going to call it shite. Agreed. Sure, there is defense at different depths, but there's no reason to add depth without adding defense as well.
jameshart 3y ago
That's a reasonable point, sure. One which can be made reasonably, without telling anyone that their attitude is cancerous.
- horsawlarway 3y ago
  I don't think that appealing to courtesy is really the play here. We are discussing ideas about security in a place and manner that allows us to have honest and frank conversations. I think security teams optimizing only for security is actually very apt analogy to cancer: Part of the organization is acting in a manner that is negatively impacting the organization at large - while positively impacting that subset of the organization. Cancer is the act of some cells in your body prioritizing themselves at the expense of the whole. Personally - I think you're digging to find an insult in that comment, and I take it as a way for you to disengage with the topic at large. This is an attitude that is routinely used to shut out voices that don't match the current "dress code". Trust me, I'm hardly going to be calling you cancer over the dinner table for not passing the salt. I'm using that word intentionally and carefully - in a frank and honest conversation. If you're feeling hurt (especially on behalf of someone else...) maybe go do something else?
_jal 3y ago
> The problem with 'defense in depth' No, that's a problem with bad engineering. That a process requires skills most people attempting it don't have isn't a problem with the process, it just means that it is hard and relatively new. One thing I see all the time that demonstrates this incompetence is talking about something being more or less "secure" without reference to a threat model. You simply can't make reasonable tradeoffs without thinking this through, and yet nobody wants to do the exercise. In fairness, this is not just an engineering fault. I've seen one case where a legal department freaked out when they heard about a risk analysis project in pursuit of a formal threat model - they vehemently objected to anyone producing documents about such things that could potentially surface in some discovery fight.
- horsawlarway 3y ago
  > One thing I see all the time that demonstrates this incompetence is talking about something being more or less "secure" without reference to a threat model. You simply can't make reasonable tradeoffs without thinking this through, and yet nobody wants to do the exercise. Hey - I completely 100% agree. Believe it or not, I did quite a stint in software security before becoming this jaded (5+ years fulltime work at a security focused product sold primarily to large fortune 100 companies [banks - it was all banks]). I think my problem is that for any difficult challenge... there is an answer that is simple, obvious, and incorrect. My opinion is that the incorrect answers I see most are the two extremes: I don't care about security (BAD!). I only care about security (WORSE!!!!). The first will eventually lead to compromised accounts/data and that can kill a company. The second will lead to products no one wants to use, which WILL kill a company. Neither is a good spot to be. You want to find an appropriate compromise in the middle: Secure enough. ---- Side note - no one truly does the threat assessments based on threat model because no one in industry likes the answers. For small and inconsequential threats - you are already secure enough. For nation states - there is likely no solution that is workable if the thing is on the internet. It's like trying to buy a secure door for your house: For most folks walking down the street, the current door is fine. When the Gov shows up with tanks - there is no door you can buy to solve the problem.
- deleted 3y ago
  [deleted]
oceanplexian 3y ago
The other thing security people fail to realize is that when you’re hostile to UX, people start coming up with all sorts of workarounds that leave you less secure than you were before. Like the corporate managed laptop is so full of spyware that users bypass it and use their own personal device for development.
- vuln 3y ago
  We don’t fail to realize that. Security folks are humans too. We realize that every human loves convenience and security removes conveniences. Simple As. No matter what we do as security folks, the users will do everything possible to return to their convenience or complain about the inconvenience until the security is removed. I’m not saying there aren’t over zealous security folk but our goal isn’t to make humans lives harder. We want to make it harder for the bad guys to ruin humans lives.
  - generalizations 3y ago
    > human loves convenience Except that it's not a matter of 'convenience', it's a matter of being able to do their jobs. Security is a hard job, in part because you have to come up with security practices that are actually workable, and keep work impediments to a minimum. It's really easy to just add more restrictions. It's hard to add security that doesn't impede the users. When I see 'defense in depth' being invoked to justify massive work impediments for minimal security improvements, I don't see effective security practices - I see a cargo cult.
  - imachine1980_ 3y ago
    not your objective is make the organización loss the less money posible by reducing the incident rate the recovery rate or the impact if you damage the org more the risk you are saving against you are liability, this isn't good vs bad thing, this is decide when the line is worth crossing and this article say at least in their opinion this open isn't, you still have multiple other layers.

horsawlarway 3y ago

> You're really angry with that straw man you've stood up. The OP isn't saying systems have to be locked down to the extent that they're useless. Who would ever argue for such a thing? You are - you're literally arguing for it right now. Short sessions just don't help all that much, and they have an outsized impact on users. Why are you dying on this hill? Likely because your mindset is "security above all else" and that mindset is literally cancer. Security above all else leads to a product that does fuck-all else (and it does it poorly).

lambic 3y ago
Literally cancer? Really?
- horsawlarway 3y ago
  Yes. Literally. I would say it makes an excellent analogy: A part of the whole (security) is prioritizing themselves and their needs in a way that makes the overall organism much less capable and effective. Cancer.
  - recursive 3y ago
    Still metaphorical cancer.
    - horsawlarway 3y ago
      Not according to the definitions of those words that I can see Metaphor: a figure of speech in which a word or phrase is applied to an object or action to which it is not literally applicable. Cancer: a practice or phenomenon perceived to be evil or destructive and hard to contain or eradicate. My usage is literal. Organizations that act this way have cancer. They suffer from it, they can be treated, they can die. It's as real as it gets. I am using cancer in the body as an analogy for this form of cancer - but I am not using a metaphor.
- paulddraper 3y ago

pxc 3y ago

> Note that "You don't stop securing it just because you've found one good option" is NOT the same thing as saying "You don't stop securing it until you've closed every possible security gap and compromised usability". It seems to me that 'defense-in-depth' can very easily become a mantra that inevitably means drifting towards the latter. What are the real guidelines for telling when enough is enough? Because ime people who even can articulate anything along those lines are way, way fewer than people who make appeals to defense-in-depth. And I think this is part of the problem: without a principled way to assess what is gratuitous, repeated appeals to defense-in-depth will lead to security practices that heavily favor having more measures in place over having a good UX. This is because the environments where information security is most valued are already organizations that frankly, do not give a shit about UX. The customers for cybersecurity products are massive bureaucracies: large enterprises, governments, and militaries. The vendors that sell those products are embedded in a broader market where no software really has to be usable, because there's a fundamental disconnect between the purchasing decision and the use of the software. For all B2B software, the user is not the customer, and it shows in a thousand ways. In infosec things are further tilted in that lots of easy routes to compliance which are terrible for UX are falsely perceived and presented as strictly required, perhaps even by law. The idea that in a B2B market which primarily serves large organizations and governments, you will get any organic weighing and balancing of security against usability 'for free' is sheer fantasy. So where is the real counterweight to the advice that on its own recommends 'always add more, unless you have good reason not to'?

horsawlarway 3y ago
I think this is a more elegantly stated version of my argument. It's also why I strongly link this argument to cancer. It's an idea that grows unbounded until it's harmful, and by the time the organization realizes the harm, it's often too late to change.
- pxc 3y ago
  > I think this is a more elegantly stated version of my argument. Yep. I think your argument pretty much conveyed the same thing, along with a lot of anger and frustration. I also agree with that anger and frustration— I've felt the same rage before, when I've been hit with blockers or UX degradation related to nominal or actual attempts to improve security. Restrictions that are ill-motivated (or whose motivations are just not clearly or convincingly communicated) are infuriating. > by the time the organization realizes the harm, it's often too late to change. This worry is the twin of the rage, for me, this sense that I can't do anything about it and it's never going to get better. A dreadful, reluctant admission to myself that the only way to stop the continual degradation of my work life will be to uproot myself: give up my job and everything I do like about it, leaving behind people I enjoy working with and reducing the amount of contact I have with them. Happily, engaging directly with my company's infosec department directly often gives me hope and allays these fears somewhat. But generally, online discussion with people who implement security controls tends to reinforce my worry that, to borrow your metaphor, the disease is systemic and terminal. Most 'cybersecurity professionals' (who are visible online, at least) transparently do not give a shit about UX, display flagrantly antagonistic attitudes about users and developers, and talk often about defense-in-depth but never articulate any inherent limits for appeals to defense-in-depth beyond 'well don't bother with measures that don't increase security at all'. All of it sends strong signals that people who value UX, DX, autonomy, morale, and well-being, to the extent they are present at all, are outliers in infosec who do not belong and have no hope of being effective. And then the response to someone openly including a dimension of emotionality in an argument about a security measure they feel is gratuitous and cumbersome is > Did... did [a cumbersome security measure] hurt you? Like, seriously? Yes. Indeed it did and does. But more than the security measures themselves, the pervasive attitude conveyed by that belittling question is the even bigger problem. And it generates many of the small ones.

dang 3y ago

Please don't cross into personal attack, no matter how bad another comment was or you feel it was. It only makes things worse. (I appreciate that you're arguing for charitable interpretation, but the personal swipes at the beginning and end of your post wipe out the good effect and then some.) https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html