4 ms·
I thought not trusting clients was already security 101?
by prmph 2y ago
I thought not trusting clients was already security 101?
- palata 2y agoIt is, but most software doesn't include security.
- edelbitter 2y agoWe're at something like 116 now and they keep coming up with funny terms for it. secure enclaves, secure virtualization, trusted execution environment, trusted platform, confidential computing, protected execution, LaGrande, protected launch, hardware attestation, ..
- ehutch79 2y agoI am still surprised by how often this is a problem
- nicman23 2y agosorry we only can install a literal rootkit on your device to detect tampering
- red_admiral 2y agoIt was, back when I took my intro to security class. And that was back in the day when we talked about domestic and export versions of RSA.
- creer 2y ago> I thought not trusting clients was already security 101? Of course it is. Always has been. The security field is riddled with complete nonsense. Much of it even couched in terms of "best practices". It's the perfect field for people with zero specific knowledge or experience to be trusted with management or engineering - since it doesn't matter until it did matter, at which point a mild non-apology is usually sufficient.
- TeMPOraL 2y agoSecurity field isn't about security, it's about managing liability. "Best Practices" don't need to result in actual security - what matters is that, if you follow them and a security incident happens, you can say you followed the Best Practices and therefore It's Not Your Fault.
- creer 2y agoYou are right. And by now an "it will be fixed next month" seems to be enough. even when nothing is fixed.
- antifa 2y agoIt's so obvious, from the title I thought the article would be about trusting B2B customers.