3 ms·

"Security" and "Convenience" is always a tradeoff, you can never have both.

bluGill 2y ago
Ture. Then the Convenience folks don't understand why the rest of us don't want the things they think are so great. There are good middle grounds, but most package managers don't even acknowledge other concerns as valid.
benterix 2y ago
This is obvious, the question here is why everybody traded security for convenience and what else has to happen for people to start taking security seriously.
- ziddoap 2y ago
  >the question here is why everybody traded security for convenience I don't think security was traded away for convenience. Everything started with convenience, and security has been trying to gain ground ever since. >happen for people to start taking security seriously Law with enforced and non-trivial consequences are the only thing that will force people to take security seriously. And even then, most probably still wont.
- vladms 2y ago
  Regarding "what else has to happen": I would say something catastrophic. Nothing comes to mind recently. Security is good, but occasionally I wonder if technical people don't imagine fantastic scenarios of evil masterminds doing something with the data and manage to rule the world. While in reality, at least the last 5 years there are so many leaders (and people) doing and saying so plainly stupid that I feel we should be more afraid of stupid people than of hackers.
  - bluGill 2y ago
    In the last 5 years several major medical providers have had sensitive person data of nearly everyone compromised. The political leaders are biggest problem today, but that could change again.
    - vladms 2y ago
      And what is the actual impact? Don't get me wrong, I don't think it is not bad, but then again abusing information could be done already by the said providers (ex: hike insurance rates based on previous conditions, taking advantage of vulnerable people). Society works by agreements and laws, not by (absolute) secrecy. There are of course instances like electrical grid stopping for days, people being killed remotely in hospitals, nuclear plants exploding, that would have a different impact and we might get there, just that it did not happen yet.
      - Tijdreiziger 2y ago
        The actual impact is that your private medical data is in the hands of thieves, which most people don’t want. It’s similar to how most people are distressed after a break-in, because they considered their home to be a private space, even though the lock manufacturer never claimed 100% security (or the thieves simply bypassed the locks by smashing a window). Agreements and laws don’t solve that problem, because thieves already aren’t stopped by those.
yjftsjthsd-h 2y ago
It's not quite a straight trade; IIRC the OpenBSD folks really push on good docs and maybe good defaults precisely because making it easier to hold the tool right makes it safer.
cyrnel 2y ago
I've seen this more formalized as a triangle, with "functionality" being the third point: https://blog.c3l-security.com/2019/06/balancing-functionality-usability-and.html?m=1 https://blog.c3l-security.com/2019/06/balancing-functionalit... You can get secure and easy-to-use tools, but they typically have to be really simple things.

Ture. Then the Convenience folks don't understand why the rest of us don't want the things they think are so great. There are good middle grounds, but most package managers don't even acknowledge other concerns as valid.

benterix 2y ago

This is obvious, the question here is why everybody traded security for convenience and what else has to happen for people to start taking security seriously.

ziddoap 2y ago
>the question here is why everybody traded security for convenience I don't think security was traded away for convenience. Everything started with convenience, and security has been trying to gain ground ever since. >happen for people to start taking security seriously Law with enforced and non-trivial consequences are the only thing that will force people to take security seriously. And even then, most probably still wont.
vladms 2y ago
Regarding "what else has to happen": I would say something catastrophic. Nothing comes to mind recently. Security is good, but occasionally I wonder if technical people don't imagine fantastic scenarios of evil masterminds doing something with the data and manage to rule the world. While in reality, at least the last 5 years there are so many leaders (and people) doing and saying so plainly stupid that I feel we should be more afraid of stupid people than of hackers.
- bluGill 2y ago
  In the last 5 years several major medical providers have had sensitive person data of nearly everyone compromised. The political leaders are biggest problem today, but that could change again.
  - vladms 2y ago
    And what is the actual impact? Don't get me wrong, I don't think it is not bad, but then again abusing information could be done already by the said providers (ex: hike insurance rates based on previous conditions, taking advantage of vulnerable people). Society works by agreements and laws, not by (absolute) secrecy. There are of course instances like electrical grid stopping for days, people being killed remotely in hospitals, nuclear plants exploding, that would have a different impact and we might get there, just that it did not happen yet.
    - Tijdreiziger 2y ago
      The actual impact is that your private medical data is in the hands of thieves, which most people don’t want. It’s similar to how most people are distressed after a break-in, because they considered their home to be a private space, even though the lock manufacturer never claimed 100% security (or the thieves simply bypassed the locks by smashing a window). Agreements and laws don’t solve that problem, because thieves already aren’t stopped by those.

yjftsjthsd-h 2y ago

It's not quite a straight trade; IIRC the OpenBSD folks really push on good docs and maybe good defaults precisely because making it easier to hold the tool right makes it safer.

cyrnel 2y ago

I've seen this more formalized as a triangle, with "functionality" being the third point: https://blog.c3l-security.com/2019/06/balancing-functionality-usability-and.html?m=1 https://blog.c3l-security.com/2019/06/balancing-functionalit... You can get secure and easy-to-use tools, but they typically have to be really simple things.