Comment by alphazard | Hacker News Reader

Comment by alphazard | Hacker News Reader

Parent Full thread

> Every time I've tried to deploy non-trivial software systems to highly secure setups it's been a tedious nightmare.

I don't know exactly which "secure setups" you are talking about, but the false equivalency between security and complexity is mostly from security theater. If you start with insecure systems and then do extra things to make them secure, then that additional complexity interacts with the thing you are trying to do. That's how we got into the mess with SE Linux, and intercepting syscalls, and firewalls, and all these other additional things that add complexity in order to claw back as much security as possible. It doesn't have to be that way and it's just an issue of knowing how.

If you start with security (meaning isolation) then passing resource capabilities in and out of the isolation boundary is no more complex than configuring the application to use the resources in the first place.

Look at how people have responded to Rust. On the one hand, the learning curve for memory safety (with lifetimes and the borrow checker) can feel exhausting when moving from something like Ruby. But once you internalize the rules, you're generally cooking without it getting in your way and experiencing the benefits naturally.

Writing secure systems feels similar. If you're trying to back port something, as you said, it can be a pain in the ass. That includes an engineer's default behavior when building something new.

Whats wrong with firewalls?

Or, how the alternative world looks where network security is more pleasant?

Firewalls are a fundamentally bad approach and are avoidable with good design.

Nothing should have access to the network by default. You can either get that right by limiting resource access (which is the job of the operating system) or you can get it wrong and have to expose new APIs and hooks to invite an ecosystem of many, slightly different, complicated tools to configure network access.

To give access to the network, you spawn the process with a handle to the port it can listen on, or a handle to a dynamically allocated port that it can only dial out of. This is no more complicated than configuration, and it doesn't have to be difficult for users. It can bubble up to a GUI very similar to what the iPhone has for giving access to location, contacts list, etc.

The fact that most "security" people have a knee-jerk reaction to "firewall bad" is exactly the cultural problem that I'm talking about. It's not a technical problem anymore, the solutions are known, but they aren't widely known, and they aren't known by decision makers. We've become so used to the wrong way for so long that highly trained people reliably have bad taste.

Reply on news.ycombinator.com