“When you get right down to it, most security is based on the honor system.”

In half-full bar at an hour when there isn't a bouncer (usually before 9pm in NYC), the only thing keeping twenty or thirty people from pouring their own booze for free is a large slab of wood and a person behind it. The name tags and maybe a counter do the same thing at a retail store with one or two checkout people.

Society is almost entirely built on a simple trust system and the fear we've built into ourselves of the repercussions for going against societal norms.

then an amazing hn-libertarian-market-forces thought hit me: why not have a market for software, where people have to pay for it? and then competition would push the people that make over-complex software out of business.

of course, if that happened, then the world described in the article would be replaced by a different one: one where no-one wants to spend money on things that don't immediately show a profit. like security. but that would be a different article...

Today's threat models are dominated by the criminal, opportunistic attackers looking for user information or computing power. Real discussion and countermeasures for focused attacks are severely lacking.

Governments know this. CISOs know this. They speak of it privately to each other, but rarely in public because the issues are so sensitive. Messaging from industry is dominated by the vendors who both have significant equities in the "we're secure!" message and speak very narrowly about the security of their applications, but rarely/never about the collection of those applications into these beasts we call networks.

Posts like this are becoming more commonplace, but neither industry nor academia are making tangible strides to solutions. If you want a startup idea, focus on security and go disrupt.

(Also, people trying to pad their work exist, but are not the chief cause of software complexity.)

It's a system in which most participants have a vested interest in the system itself working with integrity as a whole, and a substantial downside cost of being caught.

While single-round shorting of a system is highly feasible in many systems, an iterative game (there is more than one round being played) means that cheaters have to contend with the possibility of detection and retaliation. This is what keeps many meatspace systems largely honest: it's a restricted domain, biological socialization tendencies work fairly effectively (even a large city can have a "small town" feel), and reputations matter.

In the online/digital space, complexity throws most of this to whack. Any public IP is exposed, largely equivalently, to any other public IP. Attacks are generally launched through compromised systems, and those systems themselves have little reputation risk (Joe/Jane Sixpack's WinXP box doesn't particularly care if it's considered "untrusted" by small segments of the Internet).

The complexity of systems being defended makes detection of attacks in realtime (and distinguishing these from self-inflicted damage) difficult. Most attacks, if detected at all, are detected well after the fact. The noise level of constant low-grade attacks has to be factored in (or more likely: ignored). And it may be a slight escalation of an otherwise largely benign attack that takes down a system -- too high a hit rate on an expensive query, resource exhaustion, cascade effects.

Complex attacks (like complex systems) are prone to failure. Your attacker is also most likely going to KISS -- unless she has a very specific and high-payoff interest in your systems (say, Stuxnet / Duqu).

The main difference between online and physical security systems is that honor and socialization systems don't work nearly as effectively. There are measures which can help resolve this: while the Internet is vast, its infrastructure is highly concentrated among a small number of firms and entities: major routing centers, backbone links, registrars, hosting centers, and payment processors. Countering attackers at any of these points can be effective, though this usually comes with significant friendly casualties.

I'd call the premise of the article flawed, and I don't watch TV.