The Six Dumbest Ideas in Computer Security (2005)

Re:The Six Dumbest Ideas in Computer Security (2005) by closeparen on Wednesday January 25, 2023 @02:50AM (#34515591)

As long as software has bugs and accepts user input, there are going to be ways to make it do things it shouldn't. You can avoid running specific known vulnerabilities. You can avoid creating certain kinds of dumb and obvious ones. But barring, like, formal verification, it is always possible for someone smarter or more patient than the original software development team to think real hard and come up with an edge case they didn't. And operational or system-level controls can only do so much about that.

Preventing every security vulnerability is the same problem as writing bug-free code. And that is manifestly not happening, not even in the most sophisticated software development operations in the world.

[ Parent | on HN ]

Re:The Six Dumbest Ideas in Computer Security (2005) by josephg on Wednesday January 25, 2023 @04:23PM (#34524401)

Right; which is why all the things on that list are so important. We can’t seem to stop the endless flood of memory bugs in C/C++ code. Iirc 65% of security issues in chrome are due to memory corruption. But we can move to Rust and friends, where those bugs are a lot harder to write.

We’ll never get the bug count to 0. That isn’t the goal. The goal is to get the number of in-the-wild exploited vulnerabilities as low as possible. And there’s all sorts of ways to move the needle on that, which don’t require humans to suddenly become infallible.

[ Parent | on HN ]

Re:The Six Dumbest Ideas in Computer Security (2005) by zefix on Wednesday January 25, 2023 @05:04PM (#34524798)

Well said: The point is to make a proper effort to make the tools we use better.

Humans will always make errors. Let's stop denying that and start fixing the mess we are making.

[ Parent | on HN ]