Re:NSA Revelations Cast Doubt on the Entire Tech Industry
by mindslight on Saturday September 07, 2013 @02:24PM
(#6345964)
The fun you'd been having at the web services party was facilitated by denial. The software community has wasted the past several years focusing on flawed technologies, and has now built up a dependency on easy VC money (which only flows with the promise of creating new middlemen) and the glamor it brings.
The way to repent is by migrating to securable[0] technologies where possible, and deprecating insecure ones by treating them as prima facie compromised. Yes, this means giving up the unthinking conveniences you've probably become accustomed to. For instance, if you care about the security of "your data", you simply cannot have unfettered access on a contemporary mobile phone. For that capability to be created, we have to stop pretending that it already exists. Otherwise, the demand shifts towards MHz+eyecandy bumps instead of for phones that create security for their users.
[0] The primary thing for a secure technology is not to be assuredly secure, but for it to have a design goals that are compatible with security. For instance, OpenSSH may still have gaping holes in it. But when these are discovered, they are considered unambiguous bugs and they're patched to be closer to the platonic. A system that relies on storing plaintext or equivalents on someone else's server can never be patched to fix this.
The way to repent is by migrating to securable[0] technologies where possible, and deprecating insecure ones by treating them as prima facie compromised. Yes, this means giving up the unthinking conveniences you've probably become accustomed to. For instance, if you care about the security of "your data", you simply cannot have unfettered access on a contemporary mobile phone. For that capability to be created, we have to stop pretending that it already exists. Otherwise, the demand shifts towards MHz+eyecandy bumps instead of for phones that create security for their users.
[0] The primary thing for a secure technology is not to be assuredly secure, but for it to have a design goals that are compatible with security. For instance, OpenSSH may still have gaping holes in it. But when these are discovered, they are considered unambiguous bugs and they're patched to be closer to the platonic. A system that relies on storing plaintext or equivalents on someone else's server can never be patched to fix this.