Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

I mean, it's 100% going to happen again, and it was plainly obvious it was going to happen to begin with. We did a Black Hat talk about this (checks notes) 14 years ago, after being paid by a client to audit something like 12 different agent-based management systems:

https://web.archive.org/web/20061215050427/http://www.matasa...

Agent-based endpoint management is super convenient and is mainstream in modern IT management. But nobody grows up wanting to write the communications software for enterprise server inventory software, so the code quality on these products, which are ubiquitous, is awful. But 99% of enterprise buyers aren't even slightly motivated by software security when making purchasing decisions, and everyone knows it, so vendors buy fig-leaf audits from vendors who will sell public-facing documents for 2p1w engagements, and IT purchasers, whose performance reviews are based on completing projects and not protecting their companies from $500,000 purchase orders for what is effectively malware, accept those bogus reviews and get on with their lives.

Nothing is going to change about this, because nothing is going to alter the incentives. Reporters like Nicole Perlroth will try to blame it on ex-NSA hired guns (as if you needed the exploit chains NSA buys to break any of these systems), but I can't think of any realistic policy that could be applied to stop these kinds of attacks, not without massively disrupting the technology industry at the same time.

Best get used to it, is I guess my point. I mean that sincerely, not as a sort of appeal to right the ship; the ship is already upside down.

> but I can't think of any realistic policy that could be applied to stop these kinds of attacks, not without massively disrupting the technology industry at the same time

Why wouldn't Dan Geer's proposal to attach traditional products liability to closed source software improve the situation? Over time, source availability and reproducible builds should make this kind of thing a lot more difficult without wrecking anyone's budget. No?

That would work if we knew how to ship secure software at something resembling the cadence the industry demands, but we do not. We pretend to, and we get away with it because there isn't toothy liability attached to shipping bugs. We are all here, the software people on this site, the beneficiaries of that system.

Just very simple things, like reimplementing non-performance-sensitive C software from the 1990s and 2000s in simple memory-safe languages; it can't happen, the budget to make it happen would totally disrupt P&L at large companies; repeat with every well-known risk this kind of code is exposed to. I don't think we know how to solve this problem, which is why I tend to recoil from policy proposals to "solve" it.

What if the government directly paid the cost of reimplementing that old c software? If the market is failing here as it seems to be then perhaps the government should step in.

government paid $55 mil to create a simple vaccination website which doesnt work. do you think government can pull this off?

Yep. Making good software is much easier than doing anything related to healthcare.

Because it creates perverse incentives to never fix the problem, lie about it, deny it, and cover it up, because fixing it means accepting liability.

Or just distribute your source with the binary, and opt into the no liability regime.

But this does not solve the question: who is going to pay for an expert to read all the source?

The vendor's competitors, of course.

Humiliating the competition is good marketing.

LOL nope. Humiliation works only on the level which target audience understands, like performance benchmarks. Security exploits are much more esoteric and tend to result in mudfights. It already did many times, like, how many businesspeople responsible for procurement have accurate understanding of spectre/meltdown/rowhammer vulns? Why do you think AMD isn't using it for marketing against Intel?

But Solarwinds is agentless, which is what makes it attractive.

I think attacks like this show, that an intervention is very much needed. And if it is to disrupt the technology industry big time, that might just be needed as well. I mean you wouldn't have spared the tobacco industry, just because making them liable for lung cancer means disrupting the industry.

Reply on news.ycombinator.com