4 ms·

Software security is the absence of vulnerabilities, which is a special case of the absence of bugs. People are not interested in security because they are not

Software security is the absence of vulnerabilities, which is a special case of the absence of bugs. People are not interested in security because they are not interested in quality. Even those environments that are supposed to be high security, are in fact buggy, slow and very frustrating to use - revealing that they are almost certainly riddled with vulnerabilities as well. It's implausible that a system could be secure if it's not also the highest quality you've ever seen.

notepad0x90 2y ago
"Software security is the absence of vulnerabilities" I must disagree. a vulnerability where a threat actor has no way of exploiting it in the real world is not a security issue. On the flip side, a software that magically lacks any vulnerability in its code can still have design issues like bad UX or easy to misconfigure (is it elastic's fault when people expose their elastic db to the internet for example). In the software dev world, there is this view that security is absolute. in reality, it is very much relative to the data and real-world threat. Since software devs aren't expected to know details about current threats, they're expected to think in terms of absolute and hypothetical scenarios. Which is great for writing software,but when evaluating or discussing security (software or otherwise), it's not about how many vulnerabilities there are, it is about data vs threat actors and how that risk impacts you.
leonadato 2y ago
I don't think this is true. The opposite, really. I think that we continue to present security as a "shift left" ("SHIT left") strategy, dumping the responsibility on devs without any framework for why they should care. But if we built a culture and practice that low-security code is low-quality code, and made security issues a software defect like any other, it would get handled. Plenty of developers (and leads, and PMs) are fine with shipping low-security code, but would fight to the death if accused of shipping low-quality code.
fsflover 2y ago
You are talking about security through correctness, which is indeed not achievable. However it's not the only approach to security [0]. Security by isolation really works according to the statistics [1]. [0] https://blog.invisiblethings.org/2008/09/02/three-approaches-to-computer-security.html https://blog.invisiblethings.org/2008/09/02/three-approaches... [1] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/

notepad0x90 2y ago

"Software security is the absence of vulnerabilities" I must disagree. a vulnerability where a threat actor has no way of exploiting it in the real world is not a security issue. On the flip side, a software that magically lacks any vulnerability in its code can still have design issues like bad UX or easy to misconfigure (is it elastic's fault when people expose their elastic db to the internet for example). In the software dev world, there is this view that security is absolute. in reality, it is very much relative to the data and real-world threat. Since software devs aren't expected to know details about current threats, they're expected to think in terms of absolute and hypothetical scenarios. Which is great for writing software,but when evaluating or discussing security (software or otherwise), it's not about how many vulnerabilities there are, it is about data vs threat actors and how that risk impacts you.

leonadato 2y ago

I don't think this is true. The opposite, really. I think that we continue to present security as a "shift left" ("SHIT left") strategy, dumping the responsibility on devs without any framework for why they should care. But if we built a culture and practice that low-security code is low-quality code, and made security issues a software defect like any other, it would get handled. Plenty of developers (and leads, and PMs) are fine with shipping low-security code, but would fight to the death if accused of shipping low-quality code.

fsflover 2y ago

You are talking about security through correctness, which is indeed not achievable. However it's not the only approach to security [0]. Security by isolation really works according to the statistics [1]. [0] https://blog.invisiblethings.org/2008/09/02/three-approaches-to-computer-security.html https://blog.invisiblethings.org/2008/09/02/three-approaches... [1] https://www.qubes-os.org/security/xsa/ https://www.qubes-os.org/security/xsa/