Hacker News Reader

Comment by pjmlp | Hacker News Reader

Yeah, but apparently we keep getting the feedback that with good engineering practices and good strong developers, this never comes to be.

View on HN

Most hackers aren’t finding their own 0days like this. If a motivated state level attacker targets you, you’re in trouble.

But most companies that get hacked fail in much dumber ways - like failing to update chrome long after a bug like this has been fixed. Or using stupid, guessable passwords.

Of course we should have sympathy for the 1% of companies who fall victim to 0days from state level attackers. But I have no sympathy for the other 99% of data leaks where the devs forgot to put a password on a public mongodb instance, or let their login cookies be enumerable or something equally ridiculous. Just because we can’t make security perfect doesn’t mean we shouldn’t make it good.

James Mickens gave a lecture at a conference (I think it's this one: https://www.youtube.com/watch?v=tF24WHumvIc but I don't have time to actually listen through it) about how there are two different threat models for computer security: bored five year olds and the Mossad. And bored five year olds just try the same three things again and again, and as long as you take basic precautions you can protect yourself against them. You cannot protect yourself against the Mossad, don't even try.

When I first started paying attention to computer security I was at a start-up and tasked to rewrite their PCI infrastructure for credit card processing, so I did some research into the state of the art. That week news of a casino hack came out. Billionaire casino/media magnate and conservative donor Sheldon Adelson gave a speech in October 2013 about how the US should threaten to use nuclear weapons to destroy Iran's nuclear program. In February 2014 a 150 line VB virus was installed on his casino's network which wiped all of the hard drives it could find, costing the Sands hundreds of millions of dollars. This was at a casino, some place which absolutely cares about their computer security and presumably spends a lot on that security, and they failed to successfully protect themselves against a nation-state level threat.

So whatever the hell startup I was working at had no chance if someone at that level wanted it. We could stop the five year olds. Just not the nation-states.

None of these entities have unlimited resources or unlimited political cover. At some point you're making too big of a hole in the budget, too many people must be sacrificed and it's not worth it.

Seems Youtube took down that video. I get "This video isn't available anymore."

There's also the component of "there are millions of lines of existing C and C++ that continue to exist and the majority of new 'safe' languages are not designed to support gradual adoption/replacement". So you get gradual improvements to C++ that ostensibly make correct code easier (lets ignore string_view, etc) but no real path to actual safety without just rewriting everything all at once, which is an approach with a long and illustrious history of failure and major regressions even in "successful" attempts.

Is there a better way for something like an optimizing (jit) compiler? My barely informed understanding is that many of these bugs aren't soundness issues in the compilation process but instead the resulting executable code. I don't see how rust meaningfully helps with this problem.

Formal verification is often thrown around but my understanding is it can't scale to the complexity of something like an optimizing compiler.

Reply on news.ycombinator.com