3 ms·

>The Inconvenient Truth about how to actually fix this The security game is just too fast paced for a profitable business. Until we reach the point where it ma

by 1970-01-01 3y ago

>The Inconvenient Truth about how to actually fix this The security game is just too fast paced for a profitable business. Until we reach the point where it makes financial sense to move slowly and take extra time to ensure critical business systems are secure, nothing will be fixed.

LtWorf 3y ago
You mean we should make companies pay hefty fines
- drivebycomment 3y ago
  The inconvenient truth is that people say they want more, better security but they don't want to pay for it. So to survive you need "just enough" security to get by, and that "just enough" turns out to be quite low. It's also not clear if a significantly better proactive security is necessarily better - humanity is still collectively figuring out how to balance the security/privacy vs the convenience, and we do risk fossilized information technology stacks if we jump on the security too hard. That said, it's often easy things that get the most benefit and we are collectively a long way away from getting the basic security things done properly across the board.
  - LtWorf 3y ago
    > The inconvenient truth is that people say they want more, better security but they don't want to pay for it. They are already paying for it, and not getting the security.
- Loughla 3y ago
  How do you differentiate between honest to goodness mistakes and a willful/malicious attitude toward just getting (product) done to make money at all costs? It seems like a fine structure would have to take that into account? Or am I way off base?
  - ReactiveJelly 3y ago
    It's all the same to the users, and making mistakes impossible is also part of quality. I'd say go for it.
    - worthless-trash 3y ago
      You can reduce mistakes, but you can't make mistakes impossible. This is a very rough take. We wouldn't have the level of tech we have today if we were to require 'mistakes to be impossible', Rapid growth requires mistakes to be acceptable in some situations.
- rainsford 3y ago
  That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy. It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.
  - Veserv 3y ago
    You do not fine Home Depot if a suspension bridge fails because the builder decided to go there and buy the cheapest rivets to hold up their suspension bridge instead of sourcing components that meet the design specifications. You fine the bridge builder for using components unfit for purpose. For that matter, even considering to use components that unfit for purpose is inconceivable in most professions. Only in software do people use systems with no specifications, no guarantees, and where even the component makers did not intend or design them to be load bearing.
- concordDance 3y ago
  That probably costs us as a society more man hours than it saves. Particularly in reduced competition due to deep pockets being required to even play the game.
- zx8080 3y ago
  It also entrenches the Big Tech. Because what FAANG and big banks can pay, no startup or small company can afford. On the other hand, a quality needs fines. Otherwise, it's too easy to "forget" an inconvenient quality to make a short-term profit (and sometimes compromise users data).
AndyMcConachie 3y ago
We need to recognise that features bring bugs, and if we want fewer bugs we need to settle for fewer features. Same goes for security bugs as well. You can have devs work on bug fixing or you can have them work on features. Whichever brings in more money will be prioritized.
eschneider 3y ago
I dunno...It definitely makes financial sense to make sure stuff you work on doesn't appear in someone else's DEFCON presentation.
- rainsford 3y ago
  I'm not sure that's actually true, since basically every company and every project of significant size has been the subject of DEFCON presentations. Sure, it's temporarily embarrassing and unfortunate, but it's not like customers are going to move to the non-existent alternatives that have never had a security vulnerability. There's certainly degrees of CVE counts and the like, but as long as it's not egregiously worse than everyone else, being the subject of a DEFCON presentation puts you in pretty good company with literally everyone else.
  - eschneider 3y ago
    That...just isn't true. I spend a dozen years working on AI enabled surveillance cameras and there were some vendors who's cameras could continually show up and vendors (including ours :) who didn't. And while there are customers who are aware of things like this and shop accordingly, I'd personally be more concerned about my own reputation damage. It's not the sort of thing I'd like to get questions about in a job interview.
- doubled112 3y ago
  I'm not so sure. Atlassian software comes to mind as a counter-example.
rainsford 3y ago
A lot of times people compare software development in general to the amount of effort that goes into software for safety critical systems in things like airplanes or manned spaceflight. What's less talked about is that in those same areas, overall system design also focuses on reducing critical failure points through redundancy, backups, cross-checking between different sources, manual alternatives, fail-safes, etc. I totally agree that putting more thought and care into software development could certainly be beneficial, especially where security is critical. But I think the point of the article is that an alternative, and maybe more realistic, approach is to make critical systems and networks less brittle so an intentional or unintentional software issue isn't the end of the world. Even in airplanes, computers don't always work right. But it (mostly) doesn't result in planes falling out of the sky because the safety of the system as a whole isn't reliant on one piece of software working perfectly 100% of the time.
bimguy 3y ago
Businesses will lose money though, if not from the initial hack then eventually due to loss of the publics trust, ect, if the hack is made public knowledge. Surely the gov lost a lot of money from this hack assuming they had to hire consultants, ect just to deal with this massive oversight.
- genmud 3y ago
  Nah, they really don’t. The fact solarwinds or equifax exist after such egregious security errors with a botched response at best or an intentional attempt at covering up the size/scope of the problems at worse should tell you everything you need to know.

LtWorf 3y ago

You mean we should make companies pay hefty fines

drivebycomment 3y ago
The inconvenient truth is that people say they want more, better security but they don't want to pay for it. So to survive you need "just enough" security to get by, and that "just enough" turns out to be quite low. It's also not clear if a significantly better proactive security is necessarily better - humanity is still collectively figuring out how to balance the security/privacy vs the convenience, and we do risk fossilized information technology stacks if we jump on the security too hard. That said, it's often easy things that get the most benefit and we are collectively a long way away from getting the basic security things done properly across the board.
- LtWorf 3y ago
  > The inconvenient truth is that people say they want more, better security but they don't want to pay for it. They are already paying for it, and not getting the security.
Loughla 3y ago
How do you differentiate between honest to goodness mistakes and a willful/malicious attitude toward just getting (product) done to make money at all costs? It seems like a fine structure would have to take that into account? Or am I way off base?
- ReactiveJelly 3y ago
  It's all the same to the users, and making mistakes impossible is also part of quality. I'd say go for it.
  - worthless-trash 3y ago
    You can reduce mistakes, but you can't make mistakes impossible. This is a very rough take. We wouldn't have the level of tech we have today if we were to require 'mistakes to be impossible', Rapid growth requires mistakes to be acceptable in some situations.
rainsford 3y ago
That sounds great(-ish) when the company in question is one like SolarWinds that does hundreds of millions in revenue, but people and companies are equally reliant on open source software or software from tiny businesses. Trying to fine random Github users or the Linux foundation or whoever seems like a losing strategy. It also ignores the point from the article that the solution can't be trying to make all software secure. Whatever the incentive mechanism and whatever the source of the insecurity, it's unrealistic to think we're ever going to be able to make that a reality. But designing the environments software is used in such that broken software isn't the end of the world seems doable, if also incredibly difficult.
- Veserv 3y ago
  You do not fine Home Depot if a suspension bridge fails because the builder decided to go there and buy the cheapest rivets to hold up their suspension bridge instead of sourcing components that meet the design specifications. You fine the bridge builder for using components unfit for purpose. For that matter, even considering to use components that unfit for purpose is inconceivable in most professions. Only in software do people use systems with no specifications, no guarantees, and where even the component makers did not intend or design them to be load bearing.
concordDance 3y ago
That probably costs us as a society more man hours than it saves. Particularly in reduced competition due to deep pockets being required to even play the game.
zx8080 3y ago
It also entrenches the Big Tech. Because what FAANG and big banks can pay, no startup or small company can afford. On the other hand, a quality needs fines. Otherwise, it's too easy to "forget" an inconvenient quality to make a short-term profit (and sometimes compromise users data).

AndyMcConachie 3y ago

We need to recognise that features bring bugs, and if we want fewer bugs we need to settle for fewer features. Same goes for security bugs as well. You can have devs work on bug fixing or you can have them work on features. Whichever brings in more money will be prioritized.

eschneider 3y ago

I dunno...It definitely makes financial sense to make sure stuff you work on doesn't appear in someone else's DEFCON presentation.

rainsford 3y ago
I'm not sure that's actually true, since basically every company and every project of significant size has been the subject of DEFCON presentations. Sure, it's temporarily embarrassing and unfortunate, but it's not like customers are going to move to the non-existent alternatives that have never had a security vulnerability. There's certainly degrees of CVE counts and the like, but as long as it's not egregiously worse than everyone else, being the subject of a DEFCON presentation puts you in pretty good company with literally everyone else.
- eschneider 3y ago
  That...just isn't true. I spend a dozen years working on AI enabled surveillance cameras and there were some vendors who's cameras could continually show up and vendors (including ours :) who didn't. And while there are customers who are aware of things like this and shop accordingly, I'd personally be more concerned about my own reputation damage. It's not the sort of thing I'd like to get questions about in a job interview.
doubled112 3y ago
I'm not so sure. Atlassian software comes to mind as a counter-example.

rainsford 3y ago

A lot of times people compare software development in general to the amount of effort that goes into software for safety critical systems in things like airplanes or manned spaceflight. What's less talked about is that in those same areas, overall system design also focuses on reducing critical failure points through redundancy, backups, cross-checking between different sources, manual alternatives, fail-safes, etc. I totally agree that putting more thought and care into software development could certainly be beneficial, especially where security is critical. But I think the point of the article is that an alternative, and maybe more realistic, approach is to make critical systems and networks less brittle so an intentional or unintentional software issue isn't the end of the world. Even in airplanes, computers don't always work right. But it (mostly) doesn't result in planes falling out of the sky because the safety of the system as a whole isn't reliant on one piece of software working perfectly 100% of the time.

bimguy 3y ago

Businesses will lose money though, if not from the initial hack then eventually due to loss of the publics trust, ect, if the hack is made public knowledge. Surely the gov lost a lot of money from this hack assuming they had to hire consultants, ect just to deal with this massive oversight.

genmud 3y ago
Nah, they really don’t. The fact solarwinds or equifax exist after such egregious security errors with a botched response at best or an intentional attempt at covering up the size/scope of the problems at worse should tell you everything you need to know.