3 ms·
How is this not a clear example of the Shirky Principle? Institutions try to preserve the problem to which they are the solution?
by kelseyfrog 3y ago
How is this not a clear example of the Shirky Principle? Institutions try to preserve the problem to which they are the solution?
- alephnerd 3y agoCompanies have finite resources. There is a reason vulnerabilities come with Vulnerability Scores and Risk Assessment. Memory based attacks just aren't a relevant enough vector compared to other lower hanging fruit like misconfigurations or lax resource governance. This isn't to say memory attacks aren't a vector (they absolutely are), but deciding which vector is higher priority is heavily organization dependent. Also, the Shirky's Principle is pop business "knowledge" like the "Conjoined Triangles of Success" or the "Hype Cycle".
- kevingadd 3y agoEveryone says memory attacks aren't relevant until one gets used to build an exploit chain that's remotely triggered to hack your phone by sending you an SMS message. (This specific example has, iirc, happened multiple times.)
- discreteevent 3y agoThe article recognizes this: "the primary attack surface is limited chiefly to network stacks, browser APIs, and a handful of multimedia transcoding libraries."
- wtetzner 3y agoThat's not really true though. Any software that is in some way accessible over the network is a problem (which is the vast majority of software).
- timeon 3y agoBut that is the point of memory safe languages. You can shift priority to non-memory safety issues.
- deleted 3y ago[deleted]