3 ms·

While I agree that ALTER SYSTEM change is probably a good thing, I also see the pain and perspective of the people who were pushing back. Anyone who has had to

While I agree that ALTER SYSTEM change is probably a good thing, I also see the pain and perspective of the people who were pushing back. Anyone who has had to work in security knows about the endless deluge of low effort script kiddie “security reports” of non issues they have to deal with by security “researchers” fishing for a bounty. And you have to read all of them, because there’s no telling when one might be legitimate. Or you bring in some third party auditor for compliance or some other reason and they are just as clueless and snap up something like this to add to their list of “recommendations” that you have to respond to so they can feel like they are more justified collecting the paycheck. So I think implementing the feature - but being extremely loud about what it is and isn’t - is the right move here.

gizmo686 3y ago
I work on building security hardended systems, and often see the opposite problem. Engineers, even ones who should really know better, will see a feature like this and assume it creates an actual security boundary. Then they design something that relies on it for a security requirement. At that point, you need to hope someone catches the mistake, but even then, you can spend a week arguing with a non-technical manager that you need to start over, because that thing that sounds like it does exactly what you want actually provides 0 security guarantees.
- noodlesUK 3y ago
  I completely agree with this. If something seems at first blush to enforce a security control, but does not in reality, it should somehow be made very clear that it is just disabling a footgun rather than actually enforcing a security control. Either the setting in the config file needs to be named something silly like disable_alter_system_not_a_security_feature, or it needs to be overridable with something like "WITH FORCE", to make it really clear that all it is is a stumbling block rather than a control.
- qalmakka 3y ago
  This exactly. It's hard to properly understand security, even for educated professionals. IMHO security features should be the default only if they are demonstrably correct or hard to misuse. Otherwise, the often wiser thing to do is to make the danger of doing something as obvious and blatant as possible. It's like the debate around having a root account or not: IMHO it's better to have a superuser that everybody perceives as an obvious danger, that's easily recognizable and never really ok to use for mundane tasks. I've seen people misunderstanding Windows ACLs way too often because of this.
- mrguyorama 3y ago
  The reality is that your average engineer should not be considered an expert in security. You need dedicated security people with the authority to reject commits or code changes.

gizmo686 3y ago

I work on building security hardended systems, and often see the opposite problem. Engineers, even ones who should really know better, will see a feature like this and assume it creates an actual security boundary. Then they design something that relies on it for a security requirement. At that point, you need to hope someone catches the mistake, but even then, you can spend a week arguing with a non-technical manager that you need to start over, because that thing that sounds like it does exactly what you want actually provides 0 security guarantees.

noodlesUK 3y ago
I completely agree with this. If something seems at first blush to enforce a security control, but does not in reality, it should somehow be made very clear that it is just disabling a footgun rather than actually enforcing a security control. Either the setting in the config file needs to be named something silly like disable_alter_system_not_a_security_feature, or it needs to be overridable with something like "WITH FORCE", to make it really clear that all it is is a stumbling block rather than a control.
qalmakka 3y ago
This exactly. It's hard to properly understand security, even for educated professionals. IMHO security features should be the default only if they are demonstrably correct or hard to misuse. Otherwise, the often wiser thing to do is to make the danger of doing something as obvious and blatant as possible. It's like the debate around having a root account or not: IMHO it's better to have a superuser that everybody perceives as an obvious danger, that's easily recognizable and never really ok to use for mundane tasks. I've seen people misunderstanding Windows ACLs way too often because of this.
mrguyorama 3y ago
The reality is that your average engineer should not be considered an expert in security. You need dedicated security people with the authority to reject commits or code changes.