Comment by gumby | Hacker News Reader

Comment by gumby | Hacker News Reader

Parent Full thread

> I do wonder, however, how much of the "serious" nature comes from actual bad actors or from the security research community.

I think it’s hard to think of the problem that way.

These days* of course you have to worry about security on almost anything you work on. And when you do, the folks who think of security all the time are going to tell you to simplify your interfaces so they are easier to think about, then then armor them. What a pain!

But we do those things because of all the bad actors. The security recommendations are a consequence, not the cause.

* I grew up — literally — in a non-security environment: networked computers with no passwords or any other security. The only “protection” what would be called today kernel space memory barrier just to protect against bugs, and most machines didn’t have that. It was the late 70s and security was considered a barrier to hacking. I knew people working on security and frankly it seemed weird.

Counterpoint. In our org we'd eliminate pretty much every security incident if users would not download attachments on suspicious emails, give out their password and try and click on the monkey to win the iPad.

To quote James Mickens "most of the security reasearch community seems to be obssesed with avant-garde horrors such as the ability to induce a heart attack in those wearing pacemakers during a solar eclipse with a pringles can."

At this point it seems that most of it really is just security theater and most really security actually comes from proper training.

That quotation simply reflects what’s exciting enough to get attention.

And of course there are the theatrical password rotation and such that cause passwords to be written down in the first place.

But even in this comment stream someone asked who cares if the remote side learns the version number of the code you’re running, and somebody else wrote that security would not be a problem if users didn’t do what they considered foolish things. These pragmatic problems are where the risks lie.

In my household back around Y2K era (95 - 05), I eliminated a large number of virus infections by having the computer that the kids used set up so them clicking on the AIM icon actually did an X connection over ssh to my Linux server to run GAIM (using Cygwin/X on the Windows side).

Physical access to computers in the late 70s was decently secured. Most computers were at large businesses (typically with access through a lobby with a receptionist watching) or universities with access limited to students & faculty. So there was some security, not usually great, but few bad actors could get access, even across networks. As computers became more common physical-security-only stopped working well.

Indeed. Mysteriously, “firewall” devices later became popular even though they merely replicated the weaknesses of physical security.

Defense at depth is the only way to go, unfortunately.

Reply on news.ycombinator.com