5 ms·

Diversity in [the featuresets of] software systems has led to reduced security. The only systems without the “rails” to keep the user on-track and out of danger

Diversity in [the featuresets of] software systems has led to reduced security. The only systems without the “rails” to keep the user on-track and out of danger zones are those that provide the user with the ability to program it themselves. Must it be this way? Can we provide the complexity of flexibility while protecting our users’ finances and other important information? I don’t know if we can, but our track record isn’t good.

1oooqooq 2y ago
> Diversity in [the featuresets of] software systems has led to reduced security citation needed. one anecdote that comes to mind, the gnu build system had an odd assortment of machines. when they were hacked (very targeted attack) they only noticed because the malware crashed on a R6000 mips cpu or something.
- SoftTalker 2y ago
  That's also a good reason to make your code portable to other architectures, even if you don't intend to support them. Doing so can shake out bugs that would otherwise not be so apparent.
- jagged-chisel 2y ago
  I think anyone in the industry would agree that at some point, the increase in exposed surface area provided by the addition of features (and the complexity to support them) has indeed decreased security at least once in the history of software. My statement doesn't say that it always leads to reduced security. I would, however, posit that it's pretty darn close to "always."
sameoldtune 2y ago
In the context of my comment you’re thinking very small. Yes, providing more options for users can make an application less secure. But that force to make it secure is the very force I’m describing which locks down people’s options, their ability to self-express, and their options to create personal and societal value out of their actions. Every choice a programmer makes about how to model the world is a choice that is forced upon every user of their application. Many programmers lean left politically, but the same type of “fascistic” qualities they complain about in political leaders seems to go unquestioned when making a program, which dispassionately divides the world into rigid categories.
- FreakLegion 2y ago
  Technological homogeneity also creates single points of failure, as we saw this week with CrowdStrike. Heterogeneity, on the other hand, can (not will, but can) improve security outcomes. I remember making a comment years ago about opening PDFs in PDF.js instead of Acrobat (12 years, it turns out [1] -- PDF.js had just started shipping in Firefox). At the time, Acrobat was the standard and widely exploited, but obviously none of those exploits did anything in the browser. Still, homogeneity isn't always bad. If I were in, say, the cyber insurance racket, I'd make any company not using U2F or FIDO2 pay up. Not all choices are good choices. 1. https://news.ycombinator.com/item?id=4033804 https://news.ycombinator.com/item?id=4033804
- polynox 2y ago
  It is not the "dispassionate dividing of the world into rigid categories" necessary in order to implement software that is morally or ethically problematic, it is the imposition of those rigid categories upon society at large, perhaps by itself or perhaps merely just the conflation of the separation between the categories that gets incorporated into the design as a subconscious or even conscious choice to reify the categorical differences that is the problem. It is not the knowledge itself that is the problem, it is how that knowledge gets incorporated into an overly simplistic and heavy-handed approach to act. Indeed that is the very thesis of the Seeing like a State book. To take the first example of scientific forestry that replaced the local control over the land in which the categories were the species of plants as an example, it was not the factual knowledge about the species of plants, which is an observation about the true nature of reality, it was the decision to use that fact about the distinction between the plants and decide to separate the plants geographically to uniform monoculture plots rather than allowing them to be mixed together (and, in the process, in fact destroying things that they did not understand, the ecosystem) that is argued to have been the cause of the scientific forestry failure. The plots were just fine before and after the knowledge about what plants were where and what the different types of plants there were became known; it was the act of separating the plants into the monoculture plots. The knowledge was a necessary prerequisite to do so, but it was not sufficient, and I don't know if I could believe that accurate knowledge of actual pre-existing categories that correspond to the actual universe could by itself be wrong. Certain plants really are different than other plants, species actually exist. What you decide to do with that information is up to you, but I don't know if I could support the suppression of the acquisition of knowledge merely because it might (but also might not) be used in ways we disagree. If they had merely studied the plants, that would not have been wrong. If they had created a map of where the plants were, that also would not have been wrong in my view. It was when they decided to change reality that the moral implications attach, in my view. They could have mapped out the plants and divided the map into categories: "there are oak trees here and not here", or "there are strawberry bushes here, and not here", and that is "dividing the world into categories" (namely: presence or absence of certain plants in certain locations), but that is merely the true expression of factual reality. It was how they decided as a separate step, "let's make all the strawberry bushes be in the same location" which incorporated many smaller actions like "let's move this strawberry bush from here to here" or "let's remove all the plants we have not specifically identified, as we (falsely) believe that they are not essential" in which reality was actually changed, and thus the moral or ethical implication attaches in my view. Those who act have a duty to act responsibly, to do no harm, and so on, and the duty scales with the scope of the action, and perhaps there is a scope of action which by itself is too large, the standard or duty of care too impossible to satisfy due to the sheer complexity, for any one person or collection of people to rightfully possess what would be obligatory in my view to have the permission to act. I would also not view the mere publication of software as action per se either. In your example, it is the utilization of the marketing channels to push the software onto users with or without their knowledge, to exercise editorial control over what software may or may not be used on one's supposedly own device, and so on that the duty applies. If someone publishes a program that divides the world into categories, but no one uses the program, it doesn't matter how wrong the program is. The program can have a field for skin color that is literally black and white for the purpose of calibrating an algorithm that divides pixels into skin-or-not-skin, for example to cut out the background, and yet if no one actually uses, much less is forced to use the program then the mechanism of distinguishing between skin-and-not-skin being incorrect and not for example a scalar or some other model does not harm anyone. It's just an overly simplistic program, a piece of text, an incomplete idea, a reflection of a categorical distinction that does not exist in reality but only in the mind of the programmer and in the software, but if no one ever uses the software let alone is forced to use it, who possibly can be harmed by it?

1oooqooq 2y ago

> Diversity in [the featuresets of] software systems has led to reduced security citation needed. one anecdote that comes to mind, the gnu build system had an odd assortment of machines. when they were hacked (very targeted attack) they only noticed because the malware crashed on a R6000 mips cpu or something.

SoftTalker 2y ago
That's also a good reason to make your code portable to other architectures, even if you don't intend to support them. Doing so can shake out bugs that would otherwise not be so apparent.
jagged-chisel 2y ago
I think anyone in the industry would agree that at some point, the increase in exposed surface area provided by the addition of features (and the complexity to support them) has indeed decreased security at least once in the history of software. My statement doesn't say that it always leads to reduced security. I would, however, posit that it's pretty darn close to "always."

sameoldtune 2y ago

In the context of my comment you’re thinking very small. Yes, providing more options for users can make an application less secure. But that force to make it secure is the very force I’m describing which locks down people’s options, their ability to self-express, and their options to create personal and societal value out of their actions. Every choice a programmer makes about how to model the world is a choice that is forced upon every user of their application. Many programmers lean left politically, but the same type of “fascistic” qualities they complain about in political leaders seems to go unquestioned when making a program, which dispassionately divides the world into rigid categories.

FreakLegion 2y ago
Technological homogeneity also creates single points of failure, as we saw this week with CrowdStrike. Heterogeneity, on the other hand, can (not will, but can) improve security outcomes. I remember making a comment years ago about opening PDFs in PDF.js instead of Acrobat (12 years, it turns out [1] -- PDF.js had just started shipping in Firefox). At the time, Acrobat was the standard and widely exploited, but obviously none of those exploits did anything in the browser. Still, homogeneity isn't always bad. If I were in, say, the cyber insurance racket, I'd make any company not using U2F or FIDO2 pay up. Not all choices are good choices. 1. https://news.ycombinator.com/item?id=4033804 https://news.ycombinator.com/item?id=4033804
polynox 2y ago
It is not the "dispassionate dividing of the world into rigid categories" necessary in order to implement software that is morally or ethically problematic, it is the imposition of those rigid categories upon society at large, perhaps by itself or perhaps merely just the conflation of the separation between the categories that gets incorporated into the design as a subconscious or even conscious choice to reify the categorical differences that is the problem. It is not the knowledge itself that is the problem, it is how that knowledge gets incorporated into an overly simplistic and heavy-handed approach to act. Indeed that is the very thesis of the Seeing like a State book. To take the first example of scientific forestry that replaced the local control over the land in which the categories were the species of plants as an example, it was not the factual knowledge about the species of plants, which is an observation about the true nature of reality, it was the decision to use that fact about the distinction between the plants and decide to separate the plants geographically to uniform monoculture plots rather than allowing them to be mixed together (and, in the process, in fact destroying things that they did not understand, the ecosystem) that is argued to have been the cause of the scientific forestry failure. The plots were just fine before and after the knowledge about what plants were where and what the different types of plants there were became known; it was the act of separating the plants into the monoculture plots. The knowledge was a necessary prerequisite to do so, but it was not sufficient, and I don't know if I could believe that accurate knowledge of actual pre-existing categories that correspond to the actual universe could by itself be wrong. Certain plants really are different than other plants, species actually exist. What you decide to do with that information is up to you, but I don't know if I could support the suppression of the acquisition of knowledge merely because it might (but also might not) be used in ways we disagree. If they had merely studied the plants, that would not have been wrong. If they had created a map of where the plants were, that also would not have been wrong in my view. It was when they decided to change reality that the moral implications attach, in my view. They could have mapped out the plants and divided the map into categories: "there are oak trees here and not here", or "there are strawberry bushes here, and not here", and that is "dividing the world into categories" (namely: presence or absence of certain plants in certain locations), but that is merely the true expression of factual reality. It was how they decided as a separate step, "let's make all the strawberry bushes be in the same location" which incorporated many smaller actions like "let's move this strawberry bush from here to here" or "let's remove all the plants we have not specifically identified, as we (falsely) believe that they are not essential" in which reality was actually changed, and thus the moral or ethical implication attaches in my view. Those who act have a duty to act responsibly, to do no harm, and so on, and the duty scales with the scope of the action, and perhaps there is a scope of action which by itself is too large, the standard or duty of care too impossible to satisfy due to the sheer complexity, for any one person or collection of people to rightfully possess what would be obligatory in my view to have the permission to act. I would also not view the mere publication of software as action per se either. In your example, it is the utilization of the marketing channels to push the software onto users with or without their knowledge, to exercise editorial control over what software may or may not be used on one's supposedly own device, and so on that the duty applies. If someone publishes a program that divides the world into categories, but no one uses the program, it doesn't matter how wrong the program is. The program can have a field for skin color that is literally black and white for the purpose of calibrating an algorithm that divides pixels into skin-or-not-skin, for example to cut out the background, and yet if no one actually uses, much less is forced to use the program then the mechanism of distinguishing between skin-and-not-skin being incorrect and not for example a scalar or some other model does not harm anyone. It's just an overly simplistic program, a piece of text, an incomplete idea, a reflection of a categorical distinction that does not exist in reality but only in the mind of the programmer and in the software, but if no one ever uses the software let alone is forced to use it, who possibly can be harmed by it?