Hacker News Reader

Comment by jahewson | Hacker News Reader

This is a great opportunity for me to cite my new favorite thing: the OHSA Hierarchy of Controls. In the physical workplace, documenting a hazard would be seen as an inadequate control if it can simply be removed.

https://makesafetools.com/osha-hierarchy-of-controls/

If software as an industry wants to improve then its practices need to improve. We can do so much better than “be less dumb”.

View on HN

Old crypto profiles often can't be removed because there's still ancient hardware that needs to be interacted with. Exhibit A: the SSH server in my modem only speaks diffie-hellman-group1-sha1 and 3des-cbc.

So putting it in separate legacy modules, removing them from automatic negotiation and putting warnings on them is usually the best option.

> We can do so much better than “be less dumb”.

Yes. But in the end "we only had junior engineers working on this piece of infrastructure" would not fly for Boeing either.

I'm not aware of anything that needs 512 bit RSA for compatibility. At minimum generating the keys should go away.

We have been doing this software and hardware thing for a decent amount of time now. If the SSH server in your modem uses bad encryption because of a hardware issue, the company should replace it and not make their own infrastructure less security because of that. It's the issue with IoT in general, there's no maintenance plan. But some countries are enacting regulation to ensure these devices aren't left rot (and eventually become a national security issue).

I'm not saying companies should do this for free, btw.

Reply on news.ycombinator.com