4 ms·
> What is the purported lesson we should have learned? Not to automatically execute things within data that we have been sent.
by pessimizer 5mo ago
> What is the purported lesson we should have learned?
Not to automatically execute things within data that we have been sent.
- sneak 5mo agoI think it's "don't use parsers written in unsafe languages".
- fg137 5mo agoI think it's simpler: don't touch untrusted content unless/until you need to.
- stavros 5mo agoThat's easy, and already done. Phones only touch untrusted content when they need to, it's just that they need to touch it immediately upon receipt
- saagarjha 5mo agoAlas, there are a lot of things that you need to touch that are untrusted.
- marysol5 5mo agoBut that just moves it from 0-touch, to 1-touch (which is of course better). But users are morons. We STILL NOW, have people getting phished and pwning their employers.
- olyjohn 5mo agoLet's think about why that happens though We all go through that stupid phishing training. They give us a list of red flags to help determine if an email is legit. Then the next day, the CTO sends out an email that says IMPORTANT and the only text body says PLEASE READ THE ATTACHED .DOCX FILE. This is exactly what we were just trained not to open, but its from some exempt C-level who didn't have time to take the training, and all he is now doing is training the employees to open mails that look like phishing.
- NetMageSCW 5mo agoAll languages are unsafe. Some just make it less obvious.
- yard2010 5mo agoTreat every input as an attack vector.
- tialaramex 5mo agoThe subtle lesson, which we won't learn is [astronaut meme] all communication is potentially remote code execution. This isn't a computer thing, it's in the inherent nature of how communication works for us too. You can be more or less careful, but you can't eliminate the problem entirely or else communicating ceases to be effective.
- saagarjha 5mo agoHey, you! Stop executing code in my head!