4 ms·

The problem largely comes down to write secure software, a large part of which is stop doing manual memory management, to which the community responds "over my

The problem largely comes down to write secure software, a large part of which is stop doing manual memory management, to which the community responds "over my dead body." The problem isn't how security infrastructure is constructed, it's that people would rather buy "security infrastructure" and bolt it on to bad code. Laypeople have demonstrated themselves to be hopeless idiots with regard to 1) passwords and 2) infecting Windows installations for quite a while. Taking away the ability to accidentally screw these things up (2FA, sandboxing, walled garden app stores, etc) is a huge step forward.

stcredzero 11y ago
Laypeople have demonstrated themselves to be hopeless idiots with regard to 1) passwords and 2) infecting Windows installations for quite a while. The same thing can be said of certain plumbing and car repair tasks. In cases like this, industry and society should take the problematic aspects out of the hands of laypeople and put those things in the hands of tools/experts. Even highly trained groups like pilots have significant automation to aid them, where the population seems to suffer from "idiocy." (Stick shakers.) Such thinking and UX design is part and parcel of writing secure software.
pdkl95 11y ago
While I totally agree that memory management is a huge source of problems (learn Rust is next on my project queue), I suspect that the problem of "writing secure software" is not actually technical in nature. The best tools and methods in the world are only useful if they are actually used in practice. A better question is why people accept insecure software and then let the software industry blame the victims (like calling them "hopeless idiots"), when it was - as you say - the insecure software that was the actual problem. Dan Geer was right - you fix this with product liability. The tools (such as new languages like rust, etc) will happen automatically if you make the person who sold you software liable for the damage it causes. (standard "when used normally" restrictions apply, of course).
wglb 11y ago
> The problem largely comes down to write secure software, a large part of which is stop doing manual memory management, This is, unfortunately, not true. Writing in .net or in java or in php does not involve manual memory management, yet such web apps still contain game-over vulnerabilities. (I am looking at you, wordpress).

stcredzero 11y ago

Laypeople have demonstrated themselves to be hopeless idiots with regard to 1) passwords and 2) infecting Windows installations for quite a while. The same thing can be said of certain plumbing and car repair tasks. In cases like this, industry and society should take the problematic aspects out of the hands of laypeople and put those things in the hands of tools/experts. Even highly trained groups like pilots have significant automation to aid them, where the population seems to suffer from "idiocy." (Stick shakers.) Such thinking and UX design is part and parcel of writing secure software.

pdkl95 11y ago

While I totally agree that memory management is a huge source of problems (learn Rust is next on my project queue), I suspect that the problem of "writing secure software" is not actually technical in nature. The best tools and methods in the world are only useful if they are actually used in practice. A better question is why people accept insecure software and then let the software industry blame the victims (like calling them "hopeless idiots"), when it was - as you say - the insecure software that was the actual problem. Dan Geer was right - you fix this with product liability. The tools (such as new languages like rust, etc) will happen automatically if you make the person who sold you software liable for the damage it causes. (standard "when used normally" restrictions apply, of course).

wglb 11y ago

> The problem largely comes down to write secure software, a large part of which is stop doing manual memory management, This is, unfortunately, not true. Writing in .net or in java or in php does not involve manual memory management, yet such web apps still contain game-over vulnerabilities. (I am looking at you, wordpress).