2 ms·

We are perfectly capable of producing reasonably secure systems, but the present situation made that not cost-effective. It is strictly cheaper to apply securit

We are perfectly capable of producing reasonably secure systems, but the present situation made that not cost-effective. It is strictly cheaper to apply security as an after-thought or even ignore the issue completely and just pay off the penalties later.

Veserv 2y ago
What do you mean by reasonably secure system? Secure against commercially motivated attackers issuing profitable attacks that, these days, routinely payout 10-50 M$? Such security would need to be adequate to protect against 10 M$ budgets, or teams with a resource budget of 10-30 skilled people for a year (10-30 person-years). If that is not the minimum standard, then I do not see how it can be claimed to be a reasonably secure system if commonplace, expected threats with incentive to execute indefinitely are not stopped. If that is the standard, what do you mean by capable of producing such systems? Do you mean that large commercial software developers (i.e. Google, Microsoft, Amazon, etc.) have the existing knowledge and capability to develop and deploy such systems without fundamentally throwing out and redesigning their systems from scratch? If so, then that is untrue. If you merely mean that there exists or has existed such capability somewhere and that it could be reinvented or relearned with appropriate incentives, then that is true. However, that would require fundamentally redesigning basically every commercial software system and has a time horizon of years to decades even with the incentives properly aligned and having a iron will to reject insecure software systems despite the complaints by their producers which has not worked so far.
- fpoling 2y ago
  Access cards for satellite TV or SIM cards are great examples of reasonably secure systems. Surely probably for 1M$ one can hack single card, but it will be wildly unprofitable. Which demonstrates that with the right insensitive industry can develop secure stuff. And the card development took like 10 years. And it was a highly non-trivial job as it required to develop entirely new hardware. With software it must be easier. The big IT companies most likely are incapable of doing that as the security was never a hard requirement for them from the very start so it is not in their DNA and at this point they are themselves are security liability. Smaller companies on the other hand should be capable of producing software withing the right legal framework that only state actors can hack. EDIT: case in point is Google trying to prevent double-free bugs in Chromium using smart-pointers. What was originally planned to be one-year efforts took like 3 years and counting just because Google cannot afford a few percent point performance regression and various teams working on Chromium do not prioritize the relevant non-performance bugs.

Veserv 2y ago

What do you mean by reasonably secure system? Secure against commercially motivated attackers issuing profitable attacks that, these days, routinely payout 10-50 M$? Such security would need to be adequate to protect against 10 M$ budgets, or teams with a resource budget of 10-30 skilled people for a year (10-30 person-years). If that is not the minimum standard, then I do not see how it can be claimed to be a reasonably secure system if commonplace, expected threats with incentive to execute indefinitely are not stopped. If that is the standard, what do you mean by capable of producing such systems? Do you mean that large commercial software developers (i.e. Google, Microsoft, Amazon, etc.) have the existing knowledge and capability to develop and deploy such systems without fundamentally throwing out and redesigning their systems from scratch? If so, then that is untrue. If you merely mean that there exists or has existed such capability somewhere and that it could be reinvented or relearned with appropriate incentives, then that is true. However, that would require fundamentally redesigning basically every commercial software system and has a time horizon of years to decades even with the incentives properly aligned and having a iron will to reject insecure software systems despite the complaints by their producers which has not worked so far.

fpoling 2y ago
Access cards for satellite TV or SIM cards are great examples of reasonably secure systems. Surely probably for 1M$ one can hack single card, but it will be wildly unprofitable. Which demonstrates that with the right insensitive industry can develop secure stuff. And the card development took like 10 years. And it was a highly non-trivial job as it required to develop entirely new hardware. With software it must be easier. The big IT companies most likely are incapable of doing that as the security was never a hard requirement for them from the very start so it is not in their DNA and at this point they are themselves are security liability. Smaller companies on the other hand should be capable of producing software withing the right legal framework that only state actors can hack. EDIT: case in point is Google trying to prevent double-free bugs in Chromium using smart-pointers. What was originally planned to be one-year efforts took like 3 years and counting just because Google cannot afford a few percent point performance regression and various teams working on Chromium do not prioritize the relevant non-performance bugs.