Hacker News Reader

Comment by foobarqux | Hacker News Reader

When it hits hedge funds and private equity firms people will start caring.

Oh, the whole cyberwar situation is far from "hopeless". The truth is nobody to speak of has taken it seriously yet. Security is still mostly an afterthought, if that, almost everywhere you look. Even in nominally security-focused contexts. And much of the activity in places that really are security focused are built around an environment in which software must be assumed to basically be constructed out of styrofoam and radioactive waste, so they end up looking very restrictive in reaction to this reality.

I'm fairly convinced that if we all really tried we could secure things much better than they are today. The personal tripwire I've been watching for is when it finally becomes simply general knowledge that C is completely unsuitable to write security software in and C++ is pretty damned dangerous. (Many people know this, but a large contingent will still push back on that. Once we get serious about security, one of the things that will have to happen is C is going to have be evicted from its current privileged position.)

Lest I sound utopian, yes, this will require immense effort. My point is precisely that we've never really tried that level of effort yet, not that the effort will be low. There's no real reason that the Internet actually has to be made out of swiss cheese, but it will take a significant change of viewpoint before it will be resolved.

> Security is still mostly an afterthought, if that, almost everywhere you look... yes, this will require immense effort.

What I keep thinking, though, is, what would be the total dollar cost to make security a forethought, with information technology being pretty ubiquitous? I think it might actually have serious economic impact -- is it possible we literally can't afford security, as a society?

I think we could, because once we started down the path of taking security seriously, we would get better at it. What you see now is largely us not even trying. Well, just barely trying, maybe; not trying at all was the 70s. But there's still too many places where 'industry best practice' is insecure, and where even on places like HN you'll get serious fights over whether or not strong typing or even languages that prevent buffer overflows are worth it, to say nothing of what the industry at large thinks.

But there would have to be some pretty significant changes in our languages and how we program, and it probably would mean things like a certain slowing down of the rate of feature delivery.

In the long term, being unable to afford security is being unable to afford computerization at all, and the efficiency bonus is so great from computerization that it's hard to believe that we couldn't figure out how to make it work.

That's the thing. I know this is sacrilegious to say, but I wonder if the efficiency bonus from computerization really is so great, or would be, if it wasn't built on a pile of crap.

It's not ridiculous to say at all. But I think that even slow computerization is orders of magnitude better than without. And by slow, I mean like kiloflops. In all seriousness, people used to use punchcard machines and were damn glad for it, as the computers before that were even slower and more expensive. And a few generations of machines before that computers were people who computed.

We'd definitely still be using mechanical computers. But I could easily see lots of eye candy being stripped out to conserve cycles (after all, having a 3D desktop on a Pi isn't all that useful :)

Yeah, that's pretty much what I mean. We could live on a great deal less than we actually have now, and I mean, we could live quite effectively. The transition would hurt (or perhaps rather, will hurt), but in the end I think we'll all end up surprised by the fact it wasn't harder. Think Y2K here. Probably bigger than that, but in the end, more blip than crash.

Big blip, though. But at the current rate we're headed for that anyhow, regardless.

The problem with "how much" is this: as the dollar amount of loss increases, the distance between "the owners of the money" and "the people responsible for keeping it safe" also increases. I make sure I know where my wallet is, but Jeff in IT won't lose billions (or a clueless CIO, for that matter).

A serious security push might raise computing costs to the point where some low-margin computing activities become unprofitable or folks like Amazon push less into expansion/R&D to keep budgets balanced, but I think it's likely that most computerized activity would continue. Folks are gonna still gonna wanna watch Netflix or blog about cats.

>what would be the total dollar cost to make security a forethought

There isn't one. There are too many people involved who categorically refuse to consider security, and there is no way to fix that in a reasonable time frame. We'd need to fix the education problem and then wait for a whole generation of new people to go through it.

I'm actually amazed that there's someone else out there who recognizes that C and C++ have to go if we want real infosec.

I agree about C and C++, but is there a language that exists today that you think would be better for writing security-conscious code? Should a language be invented that is specifically for writing security-conscious code?

Ada is a language that is specifically for writing secure code.

Correction, Ada is a language specifically for writing correct code. Correct is only a subset of secure.

Basically all modern languages with strict type systems do better than C or C++ when it comes to security. Anything JVM based can't be buffer overflowed or double-free/use-after-free exploited, for instance.

Now if you go with a weakly typed language like Javascript there are a whole other class of bugs that can bite you:

https://medium.com/@octskyward/type-safety-and-rngs-40e3ec71...

... so don't use those.

Rust, for the former, Cryptol for the latter (just one caveat: written by the NSA/influenced people).

Hey, thanks a lot for recommending rust. Since your comment, I've investigated it, and it's exactly what I'm looking for!

Cryptol was written by Galois not the NSA. It was written for the NSA.

C is a great replacement for C. No, I don't mean that as a joke. Using C as a low level language and proving it correct via a higher level language gives you the performance of C without the security problems: http://sel4.systems/

Reply on news.ycombinator.com