News for hackers. Stuff that matters.
Re:Coding in the open: how to do it securely by EGreg on Wednesday September 27, 2017 @11:00AM (#15348418)
In the past I really worried about open source networked software, because however you slice it, it is missing a huge chunk of security by obscurity, making 0days very likely. Especially for new projects. All security vulnerabilities are out in the open for all to see. Sure, honeypots can help you learn about vulnerabilities, but it will take years to patch them all. In the meantime, everyone using your software is vulnerable.

Then I discovered blockchains. Here, the software is run by the network and does nothing persistent unless a majority of the nodes agree. That makes it much harder to corrupt the persistence layer. Blockchains are NOT just for achieving global consensus about a ledger. They can be per-stream-of-data. That's the approach we take at Qbix.

There are still many other vectors of attack besides corrupting the database. However, in Web apps, the real pernicious thing is corrupting the data. Everything else has already been secured by webserver makers and language runtime designers.

PS: Finally, you can corrupt things on the client level, eg making a client sign a transaction the user didn't authorize. But at least it is localized to the corrupted clients, and not the whole network.

There are no comments on this comment yet.