Internet Security is a Failure

But 99% of the time for 99% of people, a complete guarantee of security is overkill. With a few exceptions, as long as breaches are quickly discovered and fixed, the damage is relatively minor. Stolen credit card? Report it to your card company. Charges are blocked and you get a new card. Website vandalized? Shut it down, clone the disks on any compromised machines (for postmortem examination), restore from backups, blah blah blah standard panic procedures.

In areas where security and reliability really matter (basically: medical devices and avionics software on planes that carry people), software is expensive. Certain software development processes are required by law (See http://en.wikipedia.org/wiki/MIL-STD-2167 and http://en.wikipedia.org/wiki/DO-178B ). Greatly increasing the costs to create and use software kills new ideas in the womb. It becomes impractical for startups or small groups to build stuff.

So is Internet security a failure? Yes. But really, I'm glad we're not so risk-averse as to paralyze ourselves with more draconian measures.

Having a one-time-password setup (SecureID, for example) to a cental "admin" system that can access the remote servers directly is one layer of defense against certain workstation compromises. Using properly-configured RBAC (or better, Mandatory Access Control) with separation of duties and remote logging gives security staff tools to enforce and analyze policies and incidents.

I'm not saying it's possible to be 99% secure. To that end, I suppose Security is a "failure" (rolleyes) and as was mentioned before: you don't need 99% security, but you certainly should be able to go back and look at that other 1% after the fact.

The truth is that you really don't see security's boundaries when it's working properly. You can tell when it's getting in the way, but security is truly the most visible when it fails.

This would mean a fairly big change in the process by which software is created, but if OpenBSD can do it why do commercial companies still have problems.

Do I think this will happen? No. Will security improve much with out it? Google Chrome has some decent mechanisms and Windows 7 appears to be better, but without some kind of government legislation or regulation designed to protect John Q. Citizen, I doubt much of substance will actually happen.

So it's really a question of achieving whatever level of security is practicable in relation to its costs in time, money and energy and as for the rest...

Well read David Brin's novel "Earth" as well as his work on transparency.

The war against an Orwellian world may be better won by making EVERYBODY a potential 'big brother'... which gives no oppressor an edge.

Not sure how it'll work out, but I'd rather have everyone on a level playing field.

Should put quite a crimp in hypocrisy though... which is already happening.

1) The linked page says that it's a local DoS bug. Being subject to denial-of-service from local users is hardly critical.

2) Even if it were, as the link text seems to imply, a local privilege escalation vulnerability, it is my understanding that that sort of vulnerability is generally not considered critical, because an attacker needs to have compromised a local account to use them. Of course, if you're a shared hosting service, I suppose you might beg to differ, depending on how you're set up.

firstly there is pretty much nothing you can do to stop a determined attacker. All the trust based security in the world will break down at some point because, ultimately, computers are complex things.

Secondly the rant about law enforcement is partially bull. The major problem is catching and prosecuting hackers is involved, expensive, usually cross border and difficult to convict. How do we solve those problems? I really don't know.