10 ms·

You don't want government-mandated security specs for software projects, that would be an absolute nightmare with prescribed "sanctioned" languages and checklis

by belval 3y ago

You don't want government-mandated security specs for software projects, that would be an absolute nightmare with prescribed "sanctioned" languages and checklists applied with zero understanding of the underlying subject matter (the threat model of a video game is exceedingly different than one for a medical device). The real solution is to come up with a framework around data leaks and their disclosure with provisions for mitigations (à la GDPR, keep only the data you actually need). Anything else will end up boiling down to "Java is the best language for everything" because Oracle spend $N on lobbying.* *Replace Java/Oracle with another pair.

jowea 3y ago
But some types of software like medical or airplane controls do have those types of regulations around them, don't they? How well do they work?
- tick_tock_tick 3y ago
  Don't planes need to be restarted every few flight or all the flight input data goes crazy? https://gizmodo.com/turn-it-off-and-on-again-every-149-hours-is-a-concernin-1836818094 https://gizmodo.com/turn-it-off-and-on-again-every-149-hours...
  - stouset 3y ago
    If anything, I hope we’ve learned that node uptimes are unimportant. It used to be a badge of honor to show some system hadn’t been rebooted in $years. Now that just implies that there’s unpatched vulnerabilities and countless hand-made configuration changes that nobody remembers and that will be lost if the machine dies. A sign of a responsible organization these days is how short-lived their hosts are. If every machine in an organization has an uptime less than a week, I feel pretty confident in that org’s ability to recover from a disaster. I also know it’s harder for attackers to keep a foothold once in the system, since everything is being constantly updated and reimaged.
    - worik 3y ago
      It's true that unmatched neglected systems are a Hazzard But these days systems can be patched without restarting So "uptime" is not necessarily accurate
      - DerekL 3y ago
        * hazard Hazzard is a fictional county in Georgia that's the setting for the TV show “The Dukes of Hazzard”.
- ASalazarMX 3y ago
  Whenever we see a big mistake on these fields, it becomes a scandal. Whenever we see a big mistake in tech companies, it's just part of the daily news.
- artyom 3y ago
  TL;DR: they don't work either. See the Boeing 737MAX fiasco for reference. Regulations are pretty easy to circumvent with enough money it seems.
  - jameshart 3y ago
    Regulatory capture is a risk. The FAA allowed the max to be certified, and resisted grounding it after accidents. That is terrible, and there were congressional enquiries and legal settlements in the billions for Boeing - including several specifically for manipulating and misleading regulators. That all sounds like an argument for better regulatory oversight rather than no regulation.
    - artyom 3y ago
      I wasn't against regulatory oversight. I was mentioning that it's a system as flawed as everything else if you just expect it to work. Also I'd like this kind of direct life threatening decisions to become criminal charges (not just fines) for the ones signing them off, please, including in software regulations.
  - midoridensha 3y ago
    There was absolutely nothing wrong with the software on the 737MAX. It failed because of systems engineering, not software.
    - artyom 3y ago
      Agreed. Software doesn't happen in a vacuum tho.
- mywittyname 3y ago
  Those are easier to regulate. People research how large of a radiation dose is appropriate for an x-ray, or how long certain parts/materials can sustain what kinds of loads, and they can use this information to come up with appropriate regulations. It's much harder to come up with the same kind of concrete regulations for software security (i.e., device must deliver no more than X dosage to patient). We might have to settle for forcing companies to carry exploit insurance, and make it easy to sue for breaches.
- Veserv 3y ago
  In aerospace? Extremely well. Software (in context) that is subject to DO-178 certification is generally more reliable than the plane hardware. This is an industry where the 737 MAX, a plane safer than driving per-mile, is considered a death trap because the standard for safety is being 1000x safer than driving. The software in one of the highest reliability industries is one of the highest reliability components. Unlike in other industries, especially consumer electronics, where even in low reliability products the software is almost always the lowest reliability component. To put a more concrete take on this. In consumer systems, 5 9s is viewed as a gold standard. A level to aspire to, not necessarily one to achieve. In critical aerospace systems, 9 9s is viewed as the minimum, a level to never drop below. Many systems see 12 9s or higher. The minimum standard in aerospace is 10,000x higher than the maximum standard in consumer. And the software reaches and exceeds that standard. That is how far the gap is and how well it works. However, the downside is the expense and time. But, this can be mitigated by only applying these techniques where it matters. A key component of the DO-178 standard is identifying how critical each portion of the software is. You then only apply the most rigorous techniques for the highest criticality pieces. Of course, this requires the pieces to be well isolated, so that errors in one piece of non-critical code can not affect critical code; otherwise the non-critical code is actually, transitively, critical and thus demands increased rigor. These techniques are tried and true in the most demanding circumstances. It would be prudent to start from these expensive working standards and work downwards to invent cheap working standards rather than fixing cheap non-working standards into cheap working standards. I think every software developer here can attest to it being much easier to start from something working, no matter how crude, than to start from something broken.
  - wbl 3y ago
    I call BS on 12 9s. To actually meet that a system operating for all of the common epoch would have only 60 milliseconds of downtime. There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. As for your actual point most systems would be better with a GC'd memory safe language then the hard real time those specs you mention are written from.
    - 3y ago
eptcyka 3y ago
You don't need to mandate the solution, just punish the negative outcomes. As long as Experian and their peers can get away with dumping gigabytes of data without any punishment, they will. Apply a generous fine to any data breach or an incident resulting in monetary loss incurred due to bad software, and you'll see things change.
- SubiculumCode 3y ago
  Has there been empirical estimates of the true cost of damage caused by the Experian incident? If a major company got liquidated for extreme negligence, even once in a while, security would be much more in the forefront of executive's minds.
- EricE 3y ago
  Fines need to be percentage revenue based so they have some teeth for the big players.
lolinder 3y ago
> with prescribed "sanctioned" languages and checklists applied with zero understanding of the underlying subject matter This is always brought up as a boogeyman every time regulation is proposed, but then we have stories about Incorporation by Reference [0], where Congress explicitly encourages agencies to incorporate standards written by industry groups into law. It's not a perfect system (for example, the copyright disputes), but it seems to work a hell of a lot better than the free-for-all we have right now in our industry. > The real solution is to come up with a framework around data leaks and their disclosure with provisions for mitigations Agreed. And an agency with teeth to enforce the framework. And the provisions for mitigations should have the force of law. In other words: we need regulation! [0] https://news.ycombinator.com/item?id=37498473 https://news.ycombinator.com/item?id=37498473
RealityVoid 3y ago
It's already happening in certain areas. Check out the UNECE vehicle cybersecurity regulations: https://unece.org/DAM/trans/doc/2020/wp29grva/ECE-TRANS-WP29-2020-079-Revised.pdf https://unece.org/DAM/trans/doc/2020/wp29grva/ECE-TRANS-WP29... Thankfully, it does not contain prescribed languages, just functionalities and things you have to do.
GoblinSlayer 3y ago
There's a relatively easy way to write safe C, it's just rarely done.
- jowea 3y ago
  Care to share the secret that would have avoided countless exploits?
  - GoblinSlayer 3y ago
    Systematic use of bounded arrays, example is putty (C) and grpc (C++).

by belval 3y ago

jowea 3y ago

But some types of software like medical or airplane controls do have those types of regulations around them, don't they? How well do they work?

tick_tock_tick 3y ago
Don't planes need to be restarted every few flight or all the flight input data goes crazy? https://gizmodo.com/turn-it-off-and-on-again-every-149-hours-is-a-concernin-1836818094 https://gizmodo.com/turn-it-off-and-on-again-every-149-hours...
- stouset 3y ago
  If anything, I hope we’ve learned that node uptimes are unimportant. It used to be a badge of honor to show some system hadn’t been rebooted in $years. Now that just implies that there’s unpatched vulnerabilities and countless hand-made configuration changes that nobody remembers and that will be lost if the machine dies. A sign of a responsible organization these days is how short-lived their hosts are. If every machine in an organization has an uptime less than a week, I feel pretty confident in that org’s ability to recover from a disaster. I also know it’s harder for attackers to keep a foothold once in the system, since everything is being constantly updated and reimaged.
  - worik 3y ago
    It's true that unmatched neglected systems are a Hazzard But these days systems can be patched without restarting So "uptime" is not necessarily accurate
    - DerekL 3y ago
      * hazard Hazzard is a fictional county in Georgia that's the setting for the TV show “The Dukes of Hazzard”.
ASalazarMX 3y ago
Whenever we see a big mistake on these fields, it becomes a scandal. Whenever we see a big mistake in tech companies, it's just part of the daily news.
artyom 3y ago
TL;DR: they don't work either. See the Boeing 737MAX fiasco for reference. Regulations are pretty easy to circumvent with enough money it seems.
- jameshart 3y ago
  Regulatory capture is a risk. The FAA allowed the max to be certified, and resisted grounding it after accidents. That is terrible, and there were congressional enquiries and legal settlements in the billions for Boeing - including several specifically for manipulating and misleading regulators. That all sounds like an argument for better regulatory oversight rather than no regulation.
  - artyom 3y ago
    I wasn't against regulatory oversight. I was mentioning that it's a system as flawed as everything else if you just expect it to work. Also I'd like this kind of direct life threatening decisions to become criminal charges (not just fines) for the ones signing them off, please, including in software regulations.
- midoridensha 3y ago
  There was absolutely nothing wrong with the software on the 737MAX. It failed because of systems engineering, not software.
  - artyom 3y ago
    Agreed. Software doesn't happen in a vacuum tho.
mywittyname 3y ago
Those are easier to regulate. People research how large of a radiation dose is appropriate for an x-ray, or how long certain parts/materials can sustain what kinds of loads, and they can use this information to come up with appropriate regulations. It's much harder to come up with the same kind of concrete regulations for software security (i.e., device must deliver no more than X dosage to patient). We might have to settle for forcing companies to carry exploit insurance, and make it easy to sue for breaches.
Veserv 3y ago
In aerospace? Extremely well. Software (in context) that is subject to DO-178 certification is generally more reliable than the plane hardware. This is an industry where the 737 MAX, a plane safer than driving per-mile, is considered a death trap because the standard for safety is being 1000x safer than driving. The software in one of the highest reliability industries is one of the highest reliability components. Unlike in other industries, especially consumer electronics, where even in low reliability products the software is almost always the lowest reliability component. To put a more concrete take on this. In consumer systems, 5 9s is viewed as a gold standard. A level to aspire to, not necessarily one to achieve. In critical aerospace systems, 9 9s is viewed as the minimum, a level to never drop below. Many systems see 12 9s or higher. The minimum standard in aerospace is 10,000x higher than the maximum standard in consumer. And the software reaches and exceeds that standard. That is how far the gap is and how well it works. However, the downside is the expense and time. But, this can be mitigated by only applying these techniques where it matters. A key component of the DO-178 standard is identifying how critical each portion of the software is. You then only apply the most rigorous techniques for the highest criticality pieces. Of course, this requires the pieces to be well isolated, so that errors in one piece of non-critical code can not affect critical code; otherwise the non-critical code is actually, transitively, critical and thus demands increased rigor. These techniques are tried and true in the most demanding circumstances. It would be prudent to start from these expensive working standards and work downwards to invent cheap working standards rather than fixing cheap non-working standards into cheap working standards. I think every software developer here can attest to it being much easier to start from something working, no matter how crude, than to start from something broken.
- wbl 3y ago
  I call BS on 12 9s. To actually meet that a system operating for all of the common epoch would have only 60 milliseconds of downtime. There is no way since Wilbur and Oliver that any aerospace system could accomplish enough runtime to be sure it isn't 11 nines instead. As for your actual point most systems would be better with a GC'd memory safe language then the hard real time those specs you mention are written from.
  - 3y ago

eptcyka 3y ago

You don't need to mandate the solution, just punish the negative outcomes. As long as Experian and their peers can get away with dumping gigabytes of data without any punishment, they will. Apply a generous fine to any data breach or an incident resulting in monetary loss incurred due to bad software, and you'll see things change.

SubiculumCode 3y ago
Has there been empirical estimates of the true cost of damage caused by the Experian incident? If a major company got liquidated for extreme negligence, even once in a while, security would be much more in the forefront of executive's minds.
EricE 3y ago
Fines need to be percentage revenue based so they have some teeth for the big players.

lolinder 3y ago

> with prescribed "sanctioned" languages and checklists applied with zero understanding of the underlying subject matter This is always brought up as a boogeyman every time regulation is proposed, but then we have stories about Incorporation by Reference [0], where Congress explicitly encourages agencies to incorporate standards written by industry groups into law. It's not a perfect system (for example, the copyright disputes), but it seems to work a hell of a lot better than the free-for-all we have right now in our industry. > The real solution is to come up with a framework around data leaks and their disclosure with provisions for mitigations Agreed. And an agency with teeth to enforce the framework. And the provisions for mitigations should have the force of law. In other words: we need regulation! [0] https://news.ycombinator.com/item?id=37498473 https://news.ycombinator.com/item?id=37498473

RealityVoid 3y ago

It's already happening in certain areas. Check out the UNECE vehicle cybersecurity regulations: https://unece.org/DAM/trans/doc/2020/wp29grva/ECE-TRANS-WP29-2020-079-Revised.pdf https://unece.org/DAM/trans/doc/2020/wp29grva/ECE-TRANS-WP29... Thankfully, it does not contain prescribed languages, just functionalities and things you have to do.

GoblinSlayer 3y ago

There's a relatively easy way to write safe C, it's just rarely done.

jowea 3y ago
Care to share the secret that would have avoided countless exploits?
- GoblinSlayer 3y ago
  Systematic use of bounded arrays, example is putty (C) and grpc (C++).