Schneier on Security: Software Monoculture
schneier.com
schneier.com
The article in Information Security also has Marcus' repsonse: http://searchsecurity.techtarget.com/magazineFeature/0,29689...
While a custom culture may be safer from wide scale attacks, it's still more vulnerable to targeted attacks. If you're a bank and you rely on security-by-obscurity you are in greater danger than if using a tested and documented standard system.
As an aside, the potato famine was not caused by a singular condition. The law of the land up to some time before the famine prohibited the purchase of land by Catholics; only about 7% of the agricultural land was actually in the hands of the Irish. This meant the vast majority of them were serfs to English lords and had to rely on small/fragmented patches of land to feed themselves. The reason potatoes were grown was that no other crops could be grown on these small plots. In the absence of potatoes, people would have been starving much sooner.
There will never be enough operating environments to provide true diversity. Say there are ten end-user platforms (there are 5-6 now, including iOS and Android) each with a roughly comparable share. Each platform now has 3MM units --- a totally viable susceptible population for malware --- but only 1/10th as much security attention.
It may actually be the case that the opposite of the monoculture paper is true, and that we made it through the 2000's without melting down completely because we basically delegated software security to Microsoft, which stepped up to handle it.
Not long after the original monoculture paper came out, there was a buffer overrun in a software firewall, and the 11,000 infected machines generated enough traffic that it messed up a lot of the internet. To me this really highlighted problems both with the superficiality of model in the paper and the limitations of the biological metaphor.
That said I did think the paper was very valuable at putting the discussion on the table. Some of the risks of monoculture are very real. I was on a National Academy of Sciences panel at the time with Charles Parrow (whose book Marcus Ranum approvingly cites, although Charles actually agreed with Bruce) and we spent a lot of time discussing the arguments for and against.
Really, the sysadmins of the world were doing most of the heavy lifting.
They have definitely done some small measure of good in securing the Windows ecosystem, and in the first half of the last decade, they did far more than Microsoft.
i think there's lots of people who deserve credit for stepping up to try to handle it -- security researchers, Linux folks, and yes Microsoft (things really did change starting in 2001 or so, although of course there's still room for improvement). sysadmins are at the top of my list though and don't get anywhere neary the credit they deserve
As you said, we have to commend MSFT for stepping up on security, being a clear winner of the os race.
Every-other-web-developer's use of SHA has created vulnerabilities, from crappy password hashes through poorly-considered URL authentication schemes that have blown up on extremely well-funded teams (see: Amazon and Flickr).
Just like that Boy Scout who figured out how to extract uranium from old clocks and gas lanterns, most of the time, when lay developers try to build something with cryptography, all that happens is that a team of people in hazmat gear have to come clean up the mess.
This is the classic example of 'fools blame their tools'. AES/SHA/RSA are really good tools and great asset for crypto community.
Do you mind elaborating or linking to a useful discussion somewhere? I’m having trouble imagining just what would be better without these algorithms.
* Meanwhile, most --- literally most --- efforts at deploying crypto have reduced security, by creating new attack surfaces riddled with easily-exploitable flaws.
I don't think this is a very tricky argument, although the place it leads you to may feel counterintuitive and wrong.