Re:Mozilla Will Stop Developing and Selling Firefox OS Smart...
by nickpsecurity on Wednesday December 09, 2015 @12:09AM
(#10702018)
"people want a good product AND privacy AND security. Not fucking OR."
That's true. The problem is: what is a good product? Good is relative to what the insecure garbage on the market is offering. You can move fast, drastically add complexity, keep it extra cheap, and so on if quality or security aren't on the table. So, a good product that meets one's needs can look like a bad one if it's secure and makes right tradeoffs vs the "good product" that sells its users out.
One simple example is how several companies did high assurance VPN's whose trusted computing base was very difficult to hack. Yet, to get there, they had to eliminate most features competition was adding to their all-in-one appliances. I pointed out one could just chain them together with the high assurance solution being the interface to untrusted network. Rest of functionality can be in next device. Even such a simple scenario was almost always rejected as it was cheaper or simpler to have one do-it-all(-like-crap) device.
Apply such logic throughout entire industry and we have whole, insecure stacks that can't be made better without sacrifice. Nonetheless, companies keep trying with medium-assurance, full-featured appliances that are easy to configure. They sell very few and most go out of business. Enough said.
That's true. The problem is: what is a good product? Good is relative to what the insecure garbage on the market is offering. You can move fast, drastically add complexity, keep it extra cheap, and so on if quality or security aren't on the table. So, a good product that meets one's needs can look like a bad one if it's secure and makes right tradeoffs vs the "good product" that sells its users out.
One simple example is how several companies did high assurance VPN's whose trusted computing base was very difficult to hack. Yet, to get there, they had to eliminate most features competition was adding to their all-in-one appliances. I pointed out one could just chain them together with the high assurance solution being the interface to untrusted network. Rest of functionality can be in next device. Even such a simple scenario was almost always rejected as it was cheaper or simpler to have one do-it-all(-like-crap) device.
Apply such logic throughout entire industry and we have whole, insecure stacks that can't be made better without sacrifice. Nonetheless, companies keep trying with medium-assurance, full-featured appliances that are easy to configure. They sell very few and most go out of business. Enough said.