3 ms·

That's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché. We can and should improve development pract

That's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché. We can and should improve development practises, mitigate vulnerabities (ASLR, WAFs, etc), isolate systems from each other, and model threats in a way that we know where and how to do those things. It's not easy but just moaning "everything sucks" isn't how to fix it.

otterley 3y ago
Apple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.
- mensetmanusman 3y ago
  Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.
  - sudosysgen 3y ago
    It's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.
    - PradeetPatel 3y ago
      Difficult often implies additional resourcing and development related costs. Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values. Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.
      - sudosysgen 3y ago
        I agree, I just wanted to clarify that isn't mathematically impossible to make provably secure systems. It's just hard enough that it's not often done.
- 2OEH8eoCRo0 3y ago
  This is my take as well. If Apple and Google can't do it then what hope does anyone else have? The current paradigm is insecure and broken.
kaba0 3y ago
As sibling commenter wrote: they do exactly that. But the same way we fail to see all the cases prevented by vaccines, you only see when their work fail to work in the rare case.

otterley 3y ago

Apple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.

mensetmanusman 3y ago
Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.
- sudosysgen 3y ago
  It's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.
  - PradeetPatel 3y ago
    Difficult often implies additional resourcing and development related costs. Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values. Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.
    - sudosysgen 3y ago
      I agree, I just wanted to clarify that isn't mathematically impossible to make provably secure systems. It's just hard enough that it's not often done.
2OEH8eoCRo0 3y ago
This is my take as well. If Apple and Google can't do it then what hope does anyone else have? The current paradigm is insecure and broken.

kaba0 3y ago

As sibling commenter wrote: they do exactly that. But the same way we fail to see all the cases prevented by vaccines, you only see when their work fail to work in the rare case.