3 ms·
Why not leave it to the private sector?
by vincie 13y ago
Why not leave it to the private sector?
- tptacek 13y agoAmong other reasons, because the private sector sucks at it.
- vincie 13y agoThe latest SHA3 was determined in a competition amongst private sector contestants, won by Keccak. Schneier himself put up a candidate - Skein. Edit: Then there's TrustedBSD (as opposed to SELinux)
- tptacek 13y agoSHA3 was a contest run by NIST, known to its friends by its other name, NSA.
- deleted 13y ago[deleted]
- superuser2 13y agoHave you seen what passes for security, even in tech companies that sell primarily security?
- MichaelGG 13y agoActual quote from the CTO of a company that makes some security-related software (it's a major selling point) for a specific sector. They probably have over a hundred million people using this stuff day-to-day, indirectly, and hundreds of direct, large customers. Security bypass can easily cost hundreds of thousands a month. I had found a backdoor in their platform, so I asked if they had such basic holes, how they managed to write a large C-based app securely. Like, buffer overflows, for example. CTO/head of development replied: "Buffer overflows? Probably not an issue, unless the network is really fast." Cringe.