Comment by tux3 | Hacker News Reader

Comment by tux3 | Hacker News Reader

Parent Full thread

I think you underestimate how good the immune system is! And where the best cost/benefit security tradeoffs are, because security is always a tradeoff. (The most secure system is a dead system)

The body is constantly exposed to pathogens, all the time, in everything you eat, the air you breathe, everywhere. It is as if your laptop was downloading millions of random executables from every site you visit and hapilly running them (the analogy with Javascript and browser exploits just writes itself!)

Antibodies are in the metaphor both an allowlist AND a blacklist. Anything that isn't a well-known protein made by the body (allowed) is fair game for antibodies to bind to. You make quintillions of these that will bind to anything under the sun. Once they find a pathogen, it goes on the blacklist and more specific antibodies are made for it, that's adaptive immunity. There are many further layers and defenses on top of that, of course, but compared to infosec this is already much stricter filtering than a typical endpoint protection product.

It's easy to look at it and say hey we should lock down the cell membrane by adding randomly generated passwords and rotating them, that will improve security! But that's not realistic, a lot of simple things need to go through the cell membrane all the time.

That would be like requiring all living beings to show a passport before entering your country. Your intent is that you mostly care about catching criminals, but the border is mostly crossed by birds and small critters. The cell is the same, lots of things go in and out all the time, and they're too simple to carry any sort of identification. That's like requiring birds to have a passport.

> But that's not realistic, a lot of simple things need to go through the cell membrane all the time.

But surely something that contains an executable payload (DNA/RNA) needs to be better scrutinized than a simple nutrient. Runtime alterations of the cell code are practically never required, the fact that any code that enters the cell is fair game to execute and even to permanently alter the nucleus "binary"(retroviruses) strikes as a bad practice. A static host-key, unique per individual, would stop all such viruses.

So you cannot shake the impression that evolution does not really care about the information security of any given host. What it cares about is overall success of the gene while allowing for sufficient variation and flexibility - the retroviruses are just a tool among many to induce such genetic variability.

Nothing I say above should be taken as dismissing an exceptionally intricate and developed system, just pointing out the different way a rational attacker would approach the problem and that the defenses against such an attack would be fundamentally different than what evolution had to deal with in the past.

I wouldn't really say that it doesn't care about information security.

The DNA is actually pretty well protected, tightly wound inside the nucleus, which has pretty strong access control checks on what can enter and what can leave. It's always possible to break those protections, but a lot of effort went into "sandboxing" the rest of the cell and the nucleus.

There are also strong checks on code circulating where it isn't supposed to be. If you let RNA or DNA run around in plain sight in the blood, your immune system will react immediately with extreme prejudice and excessive violence.

But of course viruses and vaccines wrap that code in a protective layer (much like malware wraps itself with packers, obfuscation, and sophisticated delivery methods before reaching the target).

And then like you said, that protective vesicle needs some sort of static key to enter cells, it needs to target an appropriate receptor to gain entry.

Where things get complicated is that, while it would be really good to have per-host random keys, instead of a fixed set of receptors than anyone can trigger by 'putting a square shape in the square hole', the lock and key system of proteins is not one where you can generate a random receptor and the key that matches it from a seed, like you could in cryptography.

It takes huge effort and long optimization times to find a protein that matches a random receptor pretty well. The consequence is that it's non-trivial for viruses to jump between animals that have slightly different receptors, or to find a new target in a particular host. It takes a lot of optimization time to find even just a single static key that matches.

But the corollary is that it's nigh impossible for a human body to add a random per-host mutation to every receptor and everything that binds to it. It's a good idea in infosec, but because of the way proteins and chemistry work in biology, we don't have any mechanism to create the sort of defenses you care about.

Evolution does care very much about retroviruses, and in fact the defenses it put in place are able to brutally murder the overwhelming, oppressive majority of them. I think the impression that it's missing some obvious defences is due to the fact that the kind of defense that works really well in biology is very different from the kind that works well in infosec.

There are cases where evolution goes wrong, because it optimizes for the replication of the genes instead of the wellbeing of the host, that's true. But in the case of retroviruses, the host almost always loses fitness after an infection, so defending the genetic code against viruses tends to be strongly aligned with what evolution "cares about" (insofar as it "cares" about anything)

Reply on news.ycombinator.com