TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Is Security Possible?

10 点作者 pc2g4d将近 3 年前
I&#x27;ve been working on a web app for the past two years and keep having the uneasy feeling that security-wise all I&#x27;m doing is adding a few &quot;rooms&quot; to the house of cards that is today&#x27;s software and network security.<p>Would it be possible to host a single _bit_ on the web that I KNEW could not be hacked, exploited, MITM&#x27;d?<p>So much of civilization is now networked, critical infrastructure, even nuclear power plants. With the state of our security capabilities, this seems unconscionable.<p>I&#x27;d like to be part of building something that has actual security---not the whack-a-mole that is de facto for every major operating system, library, database, API, service, device, CPU architecture, programming language, etc.<p>Is security even possible?<p>I&#x27;ve learned Rust, which can solve or seriously reduce the risk of _one_ class of security holes. But that&#x27;s at best a constant-factor improvement---even if all software were competently written in memory-safe languages, the threat surface would still be unfathomably vast.<p>What are we even doing here?<p>P.S. I know this is a bit hyperbolic but... there&#x27;s got to be a better way?<p>P.P.S. The lack of security also seems to be the main threat to the Internet&#x27;s end-to-end principle, which has previously been the most empowering thing about this global network.

10 条评论

dane-pgp将近 3 年前
A helpful way to think about security is with a threat model, where you consider who the threat actors are, what they&#x27;re trying to achieve, and what their resources are.<p>Your aim shouldn&#x27;t be perfect security, but just security which is good enough that an attacker would have to spend more money on breaching your defences than the value of whatever they would gain from doing so.<p>Another way of looking at it is the through the analogy of the two hikers who see a tiger, and one of the hikers decides to change into some running shoes. &quot;You can&#x27;t outrun a tiger!&quot; &quot;I don&#x27;t have to, I just have to outrun you&quot;.<p>In a sense, security improves one hack at a time, and as long as you are doing your due diligence and being more secure than your peers&#x2F;competitors, you will be doing your bit towards improving the average security of the internet.
评论 #31556067 未加载
sanxiyn将近 3 年前
Bitcoin Piñata hosted 10 BTC for three years, so I think substantial security is possible. It had one known vulnerability (in network device driver) patched before exploited in its life, and zero exploited vulnerability (BTC is still there). Obviously we can&#x27;t know about unknown unexploited vulnerability.<p><a href="https:&#x2F;&#x2F;hannes.nqsb.io&#x2F;Posts&#x2F;Pinata" rel="nofollow">https:&#x2F;&#x2F;hannes.nqsb.io&#x2F;Posts&#x2F;Pinata</a>
评论 #31555736 未加载
E2EEd将近 3 年前
It&#x27;s all broken, but a purist will go off grid and live in the woods.<p>Perhaps you&#x27;d find passion in pursuing a PhD (or other avenue of professional R&amp;&#x2F;D) that focuses on resolving the fundamental issues with much of software development methodology, endpoint arch, and networking.<p>Barring that, the MO is to devise more robust bandaids.<p>The proprietary and secret nature of big tech security creates a playing field of fortified castles vs. self reliant survival in the wilderness. Tail end participants such as Google&#x27;s core infra security will outmatch any independent actor. And, still, both google and apple consumer endpoints seem to have fundamental security flaws, entrenched due to being built on many billions in investment over decades.<p>Something like CHERI may take decades to bear fruit, hopefully turning over and pruning any insecure legacy systems sooner rather than later. Telecom is an example of why this will likely <i>never</i> occur anytime soon, and that we may be stuck with current security paradigms for many, many decades.
评论 #31555104 未加载
avianes将近 3 年前
It all depends on your definition of &quot;secure&quot;.<p>- What kind of attack do we need to prevent?<p>- What do we need to be protected from?<p>- What do we not need to be protected from?<p>All of this (and more) must be defined in your threat model. A threat model precisely defines what &quot;security&quot; means for you in your context. Without that the concept of &quot;security&quot; remains extremely vague and therefore it can always be called imperfect against an incredibly intrusive attack
PenguinCoder将近 3 年前
&gt; Would it be possible to host a single _bit_ on the web that I KNEW could not be hacked, exploited, MITM&#x27;d?<p>If you don&#x27;t accept or deal with any user input, third party websites or state maintenance; EG entirely static content. Then yes it is possible. But as soon as you start incorporating content that isn&#x27;t static, like ads or scraping from another website&#x2F;content, or user input or a database, then no. There are certainly ways to keep your security high and prevent most types of run of the mill exploits. It&#x27;s a very broad area and entirely different methods of protection, based on say a cross site scripting exploit, server side forgery, or man in the middle attack. OWASP top ten - <a href="https:&#x2F;&#x2F;owasp.org&#x2F;www-project-top-ten&#x2F;" rel="nofollow">https:&#x2F;&#x2F;owasp.org&#x2F;www-project-top-ten&#x2F;</a> is a great resource to learn about website risk and how to improve your security.
评论 #31554681 未加载
mikewarot将近 3 年前
&gt;Would it be possible to host a single _bit_ on the web that I KNEW could not be hacked, exploited, MITM&#x27;d?<p>Yes... you need an offline host, public key crypto, a data diode, and the web host.<p>The offline host contains all the stuff you want to be <i>actually</i> read-only, and signs it. Then spools it as a stream through the data diode out to the web server, which checks the stream for errors, and makes it available to the outside world.<p>Everything in the offline host CAN&#x27;T have ingress of control thanks to the data diode. Signing prevents MITM. You&#x27;ll still be vulnerable to denial of service.
night-rider将近 3 年前
Put simply: if the network can talk to the public facing Internet, it’s vulnerable. You can solve this with airgaps but even those are vulnerable to side channel attacks. One thing you could do is remove any ‘radios’ from the machine that can be used for exfiltration and thoroughly vet and audit all your hardware. Bonus points for placing the machine in a giant Faraday cage.
devit将近 3 年前
For perfect security, the biggest problem is that you can&#x27;t buy any hardware and can&#x27;t use any third-party software because it could be malicious (and can&#x27;t hire&#x2F;delegate anything).<p>To serve anything via HTTPS you pretty much need a general purpose computer, which is going to be very challenging to build by hand from scratch starting from raw materials.
MattGaiser将近 3 年前
I am not a security expert, but we accept imperfection in everything.<p>We do not know that the bridge we are on will not fall down. We do not know that the aircraft we are on will not fall out of the sky. We do not know that we will not be misdiagnosed by a doctor. Most &quot;obvious&quot; processes and procedures had to have a body count behind them to get implemented.
netstorm将近 3 年前
Nothing is truly secure, if you realised how insecure everything really was you may not ever be the same again
评论 #31555526 未加载