Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

> Security is still mostly an afterthought, if that, almost everywhere you look... yes, this will require immense effort.

What I keep thinking, though, is, what would be the total dollar cost to make security a forethought, with information technology being pretty ubiquitous? I think it might actually have serious economic impact -- is it possible we literally can't afford security, as a society?

View on HN

I think we could, because once we started down the path of taking security seriously, we would get better at it. What you see now is largely us not even trying. Well, just barely trying, maybe; not trying at all was the 70s. But there's still too many places where 'industry best practice' is insecure, and where even on places like HN you'll get serious fights over whether or not strong typing or even languages that prevent buffer overflows are worth it, to say nothing of what the industry at large thinks.

But there would have to be some pretty significant changes in our languages and how we program, and it probably would mean things like a certain slowing down of the rate of feature delivery.

In the long term, being unable to afford security is being unable to afford computerization at all, and the efficiency bonus is so great from computerization that it's hard to believe that we couldn't figure out how to make it work.

That's the thing. I know this is sacrilegious to say, but I wonder if the efficiency bonus from computerization really is so great, or would be, if it wasn't built on a pile of crap.

It's not ridiculous to say at all. But I think that even slow computerization is orders of magnitude better than without. And by slow, I mean like kiloflops. In all seriousness, people used to use punchcard machines and were damn glad for it, as the computers before that were even slower and more expensive. And a few generations of machines before that computers were people who computed.

We'd definitely still be using mechanical computers. But I could easily see lots of eye candy being stripped out to conserve cycles (after all, having a 3D desktop on a Pi isn't all that useful :)

Yeah, that's pretty much what I mean. We could live on a great deal less than we actually have now, and I mean, we could live quite effectively. The transition would hurt (or perhaps rather, will hurt), but in the end I think we'll all end up surprised by the fact it wasn't harder. Think Y2K here. Probably bigger than that, but in the end, more blip than crash.

Big blip, though. But at the current rate we're headed for that anyhow, regardless.

The problem with "how much" is this: as the dollar amount of loss increases, the distance between "the owners of the money" and "the people responsible for keeping it safe" also increases. I make sure I know where my wallet is, but Jeff in IT won't lose billions (or a clueless CIO, for that matter).

A serious security push might raise computing costs to the point where some low-margin computing activities become unprofitable or folks like Amazon push less into expansion/R&D to keep budgets balanced, but I think it's likely that most computerized activity would continue. Folks are gonna still gonna wanna watch Netflix or blog about cats.

>what would be the total dollar cost to make security a forethought

There isn't one. There are too many people involved who categorically refuse to consider security, and there is no way to fix that in a reasonable time frame. We'd need to fix the education problem and then wait for a whole generation of new people to go through it.

Reply on news.ycombinator.com