4 ms·

Sorry, but I'm not certain how you make a business model off that idea. To win, you need to ensure that people can build and use these tools to secure the world

by dguido 12y ago

Sorry, but I'm not certain how you make a business model off that idea. To win, you need to ensure that people can build and use these tools to secure the world AND make money off it. Second, investing in security R&D is not that risky if you know who to partner with. There are many organizations whose sole purpose for existence is to fund foundational->applied R&D across a variety of fields. You seem to have mentioned none of these opportunities in your blog post? Third, if you're a software developer and you really care, the tools already exist to write secure code. However, there are few to no incentives to use them! I actually disagree somewhat that more R&D is needed on the security side. It's an inaccurate characterization of the state of the art in security and the degree to which people take advantage of it. For exampleeeee, Mayhem has found and reported hundreds of bugs in Debian and did the work to submit bug reports with reproducible crashes and POCs. I think < 10 of the bugs they reported were fixed. I can't find the link right now, but the exact systems you referenced are being used out in the open to help people and no one is listening.

dsacco 12y ago
Hey Dan, thanks for responding. I can't address your first point because I agree with it - part of the reason I'm pessimistic is because there isn't a strong business model. However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. I agree that the methodologies and tools required to write secure code already exist. However, I don't think it's fair to place all the onus on software developers. Even if they avoid C/C++, they still have modern pitfalls in just about any language. I think more research should be done on security software of course, which is why I wrote this blog post. What my post doesn't address however is that I also believe more research should be done in educating developers. It doesn't matter if all the tools to help them exist if few of them bother to look for them. Research could help in this regard - education. Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). When I say being used in the open, I mean in a similar way to Project Zero's activities. Mayhem was used once on Debian as far as I'm aware, and to my mind it looks more like publicity than an ongoing effort to find bugs.
- dguido 12y ago
  > Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). Exploitable? Every. Single. One. Each came with a unique PoC demonstrating control of execution. > However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. This sounds like you simply haven't investigated where or how to get money for R&D!

by dguido 12y ago

dsacco 12y ago

Hey Dan, thanks for responding. I can't address your first point because I agree with it - part of the reason I'm pessimistic is because there isn't a strong business model. However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. I agree that the methodologies and tools required to write secure code already exist. However, I don't think it's fair to place all the onus on software developers. Even if they avoid C/C++, they still have modern pitfalls in just about any language. I think more research should be done on security software of course, which is why I wrote this blog post. What my post doesn't address however is that I also believe more research should be done in educating developers. It doesn't matter if all the tools to help them exist if few of them bother to look for them. Research could help in this regard - education. Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). When I say being used in the open, I mean in a similar way to Project Zero's activities. Mayhem was used once on Debian as far as I'm aware, and to my mind it looks more like publicity than an ongoing effort to find bugs.

dguido 12y ago
> Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). Exploitable? Every. Single. One. Each came with a unique PoC demonstrating control of execution. > However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. This sounds like you simply haven't investigated where or how to get money for R&D!