Re:Why does APT not use HTTPS?
by kiallmacinnes on Monday January 21, 2019 @05:15AM
(#18959236)
That's not always true though, and it can be really hard to tell if a particular combination is going to make things better or worse. e.g. the "Breach" HTTPS+Compression vulnerability.
To continue your analogy: The rope gets tangled in the safety net, forcing you to jump or proceed up with a loose rope, because you can no longer move the rope..
Re:Why does APT not use HTTPS?
by marcosdumay on Monday January 21, 2019 @06:23AM
(#18959574)
This is not the physical world.
Digital security strength is measured on orders of magnitude, and two mechanisms providing security with very different orders of magnitude do not add in any practical sense.
Re:Why does APT not use HTTPS?
by julian-klode on Tuesday January 22, 2019 @01:02PM
(#18970514)
If you've seen today's bug yesterday, or carefully looked at the previous CVEs, you would have seen that https would have significantly reduced the probability of exploitability.
Re:Why does APT not use HTTPS?
by diffeomorphism on Monday January 21, 2019 @12:28PM
(#18961865)
> All software has bugs, so if you add two buggy security solutions, you might only be able to exploit a bug in one, but the other still gives you the safety.
I am unconvinced about the last part. More commonly an exploit in either will cause security to fail, so adding more steps just adds more attack surface and leads to less security.
Analogy: It's like your hanging on a rope and also add a safety net. If the rope breaks, you only fall on the safety net instead of the ground.
All software has bugs, so if you add two buggy security solutions, you might only be able to exploit a bug in one, but the other still gives you the safety.