Hacker News Reader

Comment by jka | Hacker News Reader

My memory of Dan is seeing him speak on-stage at SF security b-sides, some time in the mid 2010s.

He'd enjoyed a few drinks by the point he spoke to everyone, and the resulting honesty (accompanied by what I sensed as trepidation from the audience, about seeing a respected speaker in a vulnerable state) left a mark on me.

He was right: software security nowadays is a swiss-cheese mess, and the industry isn't addressing it.

His speech instructed me and perhaps others in the audience to deal with that new reality and adjust to it. It's tough for the original hacker / cypherpunk / purist mentality to adjust to. But it's where we are now, and it's a mindset that'll never die even if all of us that subscribe to it do.

RIP Dan.

View on HN

The parent comment was written early into my reaction to the news and I think I was a bit histrionic in my commentary about the security industry. People are helping, and that's commendable.

It can be difficult when it appears that we are building and deploying so much more software than we are maintaining and securing.

I don't know exactly what mindset will win out - either an assumption that information always leaks and that that's helpful to catch people when they might fall, and/or a mindset that believes it's necessary to be able to create private channels -- if perhaps not private spaces, for safety reasons (is there a digital distinction there? could there be?). Fragmentation and/or consensus are two possible paths forwards (that different communities are already exploring).

Maybe you weren't histrionic enough?

I couldn't name one class of software or hardware, nor one layer in the 'stack' that hasn't been compromised. The only conclusion is to admit failure (as an industry) and rebuild everything from the ground up.

We always have to do compromises designing these things. Either we don't have the talents, we disagree on the methods, we ignored a chunk of the problem, we don't have the ressources, we deliberately degrade to please the senders of a letter-we-cant-talk-about... I prefer the approach where we solve problems incrementaly as we discover them because in the long term it addresses all of those shortcomings eventually.

I agree. There will always be an attacker who knows more or who used methods that you would not choose.

It's inevitable that some things will leak. Defense in depth will help mitigate the risk and contain the fallout.

(extreme paranoia, perhaps bred of experience, doesn't hurt either!)

No, you were correct. Some people are helping here and there but overall every aspect of the software industry is an absolute mess. Most infosec pros will not point this out, either because they are tunnel visioned on their niche, are trying to sound politically correct, or just trying to not start shit (but nothing will be solved ever if people keep pretending everything's all and well).

Reply on news.ycombinator.com