Hacker News Reader

Comment by ketralnis | Hacker News Reader

That's needlessly defeatist and "it's so bad out there there's no point in trying" is a thought terminating cliché.

We can and should improve development practises, mitigate vulnerabities (ASLR, WAFs, etc), isolate systems from each other, and model threats in a way that we know where and how to do those things. It's not easy but just moaning "everything sucks" isn't how to fix it.

View on HN

Apple, Google, etc. have whole teams of talented people dedicated to doing exactly these types of things, and they undoubtedly help prevent many vulnerabilities from escaping the labs. Yet vulnerabilities are still created and exploited despite their best efforts. As long as software is created by imperfect humans, it will reflect the imperfections of its creators.

Not only humans, the math says it’s not knowable whether any open ended hardware/software is inherently safe.

It's not knowable for any, but it is knowable for some. You just have to build systems that are in the some and are inherently safe. Difficult, not impossible.

Difficult often implies additional resourcing and development related costs.

Something that many companies are not willing to invest in since it will have a negative impact on the shareholder values.

Often risks are accepted, and cybersecurity insurance is used to mitigate those risks.

I agree, I just wanted to clarify that isn't mathematically impossible to make provably secure systems. It's just hard enough that it's not often done.

This is my take as well. If Apple and Google can't do it then what hope does anyone else have? The current paradigm is insecure and broken.

As sibling commenter wrote: they do exactly that. But the same way we fail to see all the cases prevented by vaccines, you only see when their work fail to work in the rare case.

Reply on news.ycombinator.com