3 ms·

Your post is filled with absolutes, where in reality, it's rarely that clear. I understand it's what gets the people to read and pay attention, but I'm gonna ha

by yan 18y ago

Your post is filled with absolutes, where in reality, it's rarely that clear. I understand it's what gets the people to read and pay attention, but I'm gonna have to disagree that it's always harder to break something than to build it. Writing complex software securely is hard. I'd argue writing WebKit is much harder than attacking it. Even Miller bragged about how easy it was to break it. Especially now, fuzzing is so hot exactly for the reason that it lets people collect vulns from software they just shook without too much insight. Writing exploits is getting harder and harder with modern operating systems, I'll give you that, but classically, defense has been harder than offense. I'm not exactly arguing your position, I'm technically in the security industry myself, but limiting examples of breaking things to Dowd's super-human exploit or cryptanalysis of modern algorithms is just as disingenuous, just as making absolute statements like "That's because it isn't easier to break things than to build them". I'm sure you had the experience of walking into a pen-test and delivering a list of vulnerabilities in laughably misconfigured and outdated software. I just don't understand why one field has to be harder or more elite than another. Both have hard, interesting work with brilliant people.

tptacek 18y ago
I do tend to advocate the opposite of the "harder to build than break" argument, and that argument is, I suppose, just as faulty. I agree with your last paragraph. It is, in the end, just a stupid argument. However, my side of this argument is just disingenuous, while Winkler's side is a pernicious industry fallacy that genuinely has set us back: it's embedded into several of the bullshit certifications that gate some high-paying jobs, and it's a consistent excuse for practitioners to avoid keeping technically sharp for for implementors to avoid responsibility for the code they ship. So while recognizing that you are right about the merits of the argument, I am unlikely to stop making it.

by yan 18y ago

tptacek 18y ago

I do tend to advocate the opposite of the "harder to build than break" argument, and that argument is, I suppose, just as faulty. I agree with your last paragraph. It is, in the end, just a stupid argument. However, my side of this argument is just disingenuous, while Winkler's side is a pernicious industry fallacy that genuinely has set us back: it's embedded into several of the bullshit certifications that gate some high-paying jobs, and it's a consistent excuse for practitioners to avoid keeping technically sharp for for implementors to avoid responsibility for the code they ship. So while recognizing that you are right about the merits of the argument, I am unlikely to stop making it.