4 ms·

Software is in a very unique position. It can be attacked all the time with completely impunity. Buildings are completely vulnerable even to simple hammer brea

by mnau 3y ago

Software is in a very unique position. It can be attacked all the time with completely impunity. Buildings are completely vulnerable even to simple hammer breaking windows, locks have been basically broken for decades Food processor is easily vulnerable to poisoned potato. Only the software has to take all attacks humans can come up with and withstand it. What other industry has to deal with that? Maybe military, army camp in middle of enemy territory? We have improved massively and will and should continue to do, but it's very different from other industries. That's the core reason for breaches. Some security checklist will help to filter most egregious idiots (especially upgrades from vulnerable versions).

Anechoic 3y ago
If a system is attacked or fails in novel way, and the system design was done in accordance with best-practices, the follow-up investigation will note this, the system implementers will in all likelihood not face any repercussions (because they weren't negligent) and the standards will be updated to account for the new vulnerability. Just like other engineering disciplines. Yes, things are constantly evolving in computer engineering, but how many of the failures that make the news are caused by novel new attack vectors, versus not following best-practices?
twh270 3y ago
We don't live in a hard, binary world of extremes. Yes -- buildings and locks are, for the most part, easily compromised. But... If I make a window of bulletproof glass, it's a lot harder to compromise. If I surround my building with a wall topped by razor wire, it's a lot harder to compromise. (Unless, of course, I'm making an action film.) Depending on what or who I'm protecting, I might find these solutions very valuable. Similarly in software, depending on what or who I am protecting, I might be very interested in various security measures. So far, we've managed to escape an incident where bad actors have compromised systems in a way that's led to severe loss or harm. People are terrible at evaluating risk, so people tend to assume the status quo is okay. It's not, and it's only a matter of time before a bad actor does some real damage. Think 9/11 style, something that causes an immediate reaction and shocks the population. Then, suddenly, our politicians will be all in favor of requiring software developers to be licensed; liability for companies that allow damages; etc.

by mnau 3y ago

Anechoic 3y ago

If a system is attacked or fails in novel way, and the system design was done in accordance with best-practices, the follow-up investigation will note this, the system implementers will in all likelihood not face any repercussions (because they weren't negligent) and the standards will be updated to account for the new vulnerability. Just like other engineering disciplines. Yes, things are constantly evolving in computer engineering, but how many of the failures that make the news are caused by novel new attack vectors, versus not following best-practices?

twh270 3y ago

We don't live in a hard, binary world of extremes. Yes -- buildings and locks are, for the most part, easily compromised. But... If I make a window of bulletproof glass, it's a lot harder to compromise. If I surround my building with a wall topped by razor wire, it's a lot harder to compromise. (Unless, of course, I'm making an action film.) Depending on what or who I'm protecting, I might find these solutions very valuable. Similarly in software, depending on what or who I am protecting, I might be very interested in various security measures. So far, we've managed to escape an incident where bad actors have compromised systems in a way that's led to severe loss or harm. People are terrible at evaluating risk, so people tend to assume the status quo is okay. It's not, and it's only a matter of time before a bad actor does some real damage. Think 9/11 style, something that causes an immediate reaction and shocks the population. Then, suddenly, our politicians will be all in favor of requiring software developers to be licensed; liability for companies that allow damages; etc.