Comment by manholio | Hacker News Reader

Comment by manholio | Hacker News Reader

In terms of information security, as viewed by an infosec engineer, biological systems seem to have incredibly weak architecture. Hear me out, please.

If any piece of DNA code manages to find its way into the nucleus, it's happily added to the cell "runtime" and has root access to the system.

To defend against this, biology relies on multiple layers of security, both physical, like the skin, and chemical, like the secret protein password it requires to allow foreign DNA to breach the cell membrane. But both are easily circumvented, for example weak points exist in the physical layer and the protein passwords are static and low entropy, easy to bruteforce by an enemy that already has a botnet of infected hosts which produce random permutations of these keys.

And once infection happens, the body response is sort of like the experience of cleaning a Windows 98 which has been used by your grandma to surf the internet for the last two decades, without the option to do a fresh install (kill the host). It's messy and insanely complex - the sort of thing you would expect blind evolution to generate against a blind, brute-forcing script kiddie.

You just have to wonder what are our chances on this planet if intelligent and rational enemies, be they human or AI, gain the knowledge, tools and motivation to attack biological systems and intelligently design sophisticated attack vectors. Our most precious systems are wide open, folks.

Perhaps some day, to prevent such attacks, we will take control of this complex immune machinery and inject ourselves with highly engineered "anti-viruses" built on the same info-sec principles we build software on.

I think you underestimate how good the immune system is! And where the best cost/benefit security tradeoffs are, because security is always a tradeoff. (The most secure system is a dead system)

The body is constantly exposed to pathogens, all the time, in everything you eat, the air you breathe, everywhere. It is as if your laptop was downloading millions of random executables from every site you visit and hapilly running them (the analogy with Javascript and browser exploits just writes itself!)

Antibodies are in the metaphor both an allowlist AND a blacklist. Anything that isn't a well-known protein made by the body (allowed) is fair game for antibodies to bind to. You make quintillions of these that will bind to anything under the sun. Once they find a pathogen, it goes on the blacklist and more specific antibodies are made for it, that's adaptive immunity. There are many further layers and defenses on top of that, of course, but compared to infosec this is already much stricter filtering than a typical endpoint protection product.

It's easy to look at it and say hey we should lock down the cell membrane by adding randomly generated passwords and rotating them, that will improve security! But that's not realistic, a lot of simple things need to go through the cell membrane all the time.

That would be like requiring all living beings to show a passport before entering your country. Your intent is that you mostly care about catching criminals, but the border is mostly crossed by birds and small critters. The cell is the same, lots of things go in and out all the time, and they're too simple to carry any sort of identification. That's like requiring birds to have a passport.

> But that's not realistic, a lot of simple things need to go through the cell membrane all the time.

But surely something that contains an executable payload (DNA/RNA) needs to be better scrutinized than a simple nutrient. Runtime alterations of the cell code are practically never required, the fact that any code that enters the cell is fair game to execute and even to permanently alter the nucleus "binary"(retroviruses) strikes as a bad practice. A static host-key, unique per individual, would stop all such viruses.

So you cannot shake the impression that evolution does not really care about the information security of any given host. What it cares about is overall success of the gene while allowing for sufficient variation and flexibility - the retroviruses are just a tool among many to induce such genetic variability.

Nothing I say above should be taken as dismissing an exceptionally intricate and developed system, just pointing out the different way a rational attacker would approach the problem and that the defenses against such an attack would be fundamentally different than what evolution had to deal with in the past.

I wouldn't really say that it doesn't care about information security.

The DNA is actually pretty well protected, tightly wound inside the nucleus, which has pretty strong access control checks on what can enter and what can leave. It's always possible to break those protections, but a lot of effort went into "sandboxing" the rest of the cell and the nucleus.

There are also strong checks on code circulating where it isn't supposed to be. If you let RNA or DNA run around in plain sight in the blood, your immune system will react immediately with extreme prejudice and excessive violence.

But of course viruses and vaccines wrap that code in a protective layer (much like malware wraps itself with packers, obfuscation, and sophisticated delivery methods before reaching the target).

And then like you said, that protective vesicle needs some sort of static key to enter cells, it needs to target an appropriate receptor to gain entry.

Where things get complicated is that, while it would be really good to have per-host random keys, instead of a fixed set of receptors than anyone can trigger by 'putting a square shape in the square hole', the lock and key system of proteins is not one where you can generate a random receptor and the key that matches it from a seed, like you could in cryptography.

It takes huge effort and long optimization times to find a protein that matches a random receptor pretty well. The consequence is that it's non-trivial for viruses to jump between animals that have slightly different receptors, or to find a new target in a particular host. It takes a lot of optimization time to find even just a single static key that matches.

But the corollary is that it's nigh impossible for a human body to add a random per-host mutation to every receptor and everything that binds to it. It's a good idea in infosec, but because of the way proteins and chemistry work in biology, we don't have any mechanism to create the sort of defenses you care about.

Evolution does care very much about retroviruses, and in fact the defenses it put in place are able to brutally murder the overwhelming, oppressive majority of them. I think the impression that it's missing some obvious defences is due to the fact that the kind of defense that works really well in biology is very different from the kind that works well in infosec.

There are cases where evolution goes wrong, because it optimizes for the replication of the genes instead of the wellbeing of the host, that's true. But in the case of retroviruses, the host almost always loses fitness after an infection, so defending the genetic code against viruses tends to be strongly aligned with what evolution "cares about" (insofar as it "cares" about anything)

The issue is it was never designed - just trail and error that nature got something that works but is kind of fragile but good enough that it works for the majority of use cases.

Jerry rigged.

A colleague has been diagnosed with Type 1 diabetes recently because his immune system decided last year the beta cells making insulin in his pancreas is now fair game.

Then the recent papers show that cells in the pancreas duct has the ability to regulate T cell activity as if this is a known bug and more of us would get Type 1 than currently if it were not the case.

As I said jerry rigged.

My suggestions as a T1D, Melatonin upregulates the insulin receptor so you need less. This also helps T2D. Second there have been spontaneous remissions after the BCG Tuburculosis vaccine, it some how stops that anti-islet cell immunity. Bonus tip. Have them calculate half their weight in kilograms, that gives the number of carbs a 100mg/dl blood sugar equals. This helps with adjusting blood sugar up or down incrementally. Finally serious low blood sugar often start with a bleek mood or motor coordination loss. The shifts in consciousness are the most emotionally and interpersonally hard parts of this. They should not hide their condition and should wear a bracelet with info, one can become blackout drunk like in behavior. The new constant sensors are amazing for learning and monitoring.

Well it is on my mind since he collapsed last week due to hyperglycemia, the new monitoring (CGM)/insulin pumps are amazing but you need a decent medical scheme and co-pay a large part of it.

Actually, retroviruses have contributed ~8% of human DNA, so you could say that past rootkits have been incorporated into the current ("OS") platform. I understand the mammalian placenta required the added viral genetic components to evolve.

These retrovirus fragments can surface as "transposons" where they will copy themselves up to thousands of times over the DNA of the cell, which can happen about once a month. There are also "gypsy transposons" that encapsulate these viral fragments in a package that can "infect" a neighboring cell.

Germline cells have special mechanisms to silence transposon activity, otherwise reproduction would be much more problematic.

As is common in IT, only the bare minimum necessary level of security.

Yeah, short of a complete rewrite in Rust, I don't see how we could survive on the long run.

It's a feature, not a bug. As tux3 describes there has to be a combination between easy access and dealing with threats.

I would like to add to tux3's comparison that in this analogy the small criters are vital for cell-health, they bring resources. And i would also like to add that nature has a way of propagating the white/black-list as well which means that predators get "marked" hence the mutation (a bit like a criminal wearing a disguise?) element viruses have is so important for them, and the thing that makes them so dangerous.

But that's where the "virus" metaphor comes from...

> Hear me out, please.

Nope. And I hate that phrase, it rarely pans out with anything that makes any sense.

Yeah it would be great if Nabs were all we needed and they were all sterilizing and permanent so any foreign pathogen was instantly destroyed.

But the immune system has a complicated friend-or-foe problem which pathogens are constantly trying to exploit.

I've had virus-triggered pericarditis before where presumably igG Nabs to the cold virus I had managed to attack my pericardium. Having T-cells and B-cells be latent and ready to activate on infection and not constantly attacking surface proteins is a good thing. Waning Nabs is a feature, not a bug.

And the multilayered approach to the immune system probably means that immune escape of viruses is shuttled down the route where viruses focus on Nabs, while the multiple kinds of TLA subtypes and the secondary defense of the humoral immune system mean that T-cell epitopes are not the focus of viral evolution and immune escape.

The immune system evolved the way it did based on a 500M year long arms race between eucaryotes and pathogens, it is really quite good at what it does.

Of course there's weaknesses in it, but we have the advantage of looking at the specific virus or pathogen that we're concerned with and spending great effort to custom design treatments, while the body needs to individually react to any possible pathogen that the body might encounter on its own. We can do custom bespoke treatment having analyzed the pathogen extensively to start with, while the immune system's battle starts the moment there's first contact by the individual organism with the enemy. It works great for solving that latter problem.

Most pathogens also never gain access to the nucleus and can't be transcribed into the nucleus.

And even there, the reason why we have a placenta and are mammals is likely because some organism was infected by a retrovirus and learned to form syncytia and learned a knew trick from a virus. Evolution can take a seeming "fault" like that and turn it into a strength on the long-term.

Most likely all we need to do is be able to sit down with any particular individual human's immune system and convince it to attack something even though the immune system has concerns about friendly-fire issues. Although the problem of doing something like clearing EBV out of the neurons of someone who is at risk of developing MS is problematic since you don't want to kill a lot of EBV-infected neurons (which is probably a "fault" of the nerve system rather than being a fault of the immune system -- but one again it is likely a necessary "fault" given the fact that we don't want to be scattershot blowing away nerves). That is likely to look more like CRISPR treatment to gene-edit the virus out of the DNA of those neurons. The DNA viruses that incorporate into neurons of T lymphocytes, B lymphocytes and neurons are indeed problematic, but that is a very small number of pathogens that manage to get past all those defenses that we have, there's a heavy amount of survivorship/selection bias there. The hundreds of cold viruses out there we clobber pretty routinely. For most everything else the ability to regenerate cells with the ability to kill infected cells works fine. The cells which "learn" stuff is where things get really tricky. That is almost like a UEFI rootkit. And our ability to prevent computer viruses is also primitive, we have some general heuristics to quarantine virus-looking code but it has a ton of false positives and we mostly rely on distribution of signatures of the virus once researchers have analyzed infected computers. The human immune system can protect against viruses that the human race has never encountered before.

> I hate that phrase, it rarely pans out with anything that makes any sense.

That's just the evolutionary loop of contrarian views. Of course the large majority will be crap, because that's why the mainstream views are dominant.

But sometimes, even if short of an infosec revolution in immunology, which was clearly a rhetorical stretch on my part, some contrarian view will make people think in a different way or challenge them to defend mainstream views and really think really hard about why those views are what they are. It seems by the bulk and quality of the responses that I have achieved such an effect, so the whole exercise was not so non-sensical.

> And even there, the reason why we have a placenta and are mammals is likely because some organism was infected by a retrovirus and learned to form syncytia and learned a knew trick from a virus. Evolution can take a seeming "fault" like that and turn it into a strength on the long-term.

I think this is the crux of the argument right here. Evolution is satisfied and will even favor a certain number of informational security compromises if it induces variability that has (even a small chance of) improving long term fitness. But the perspective I was approaching the problem was short term host security - the thing we, as rational members of a given species living in the present day care about, because we know full well that the vast majority of compromised individuals will not survive. So we are likely to make a different short term tradeoff, even if it hurts the long term fitness of the species. Modern medicine and social security systems already do that to a large degree.

More generally, the perspective I wanted to present was that of intelligent design versus evolutionary fitness, that a blind watchmaker might leave gaping design holes for a malevolent rational attacker. I think there is ample evidence that evolution by natural selection is not all powerful and all knowing against rationality (at least if we don't consider rationality just another facet of evolution).

Reply on news.ycombinator.com