TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The six dumbest ideas in computer security (2005)

265 点作者 sweenycod超过 2 年前

41 条评论

dang超过 2 年前
Related:<p><i>The Six Dumbest Ideas in Computer Security (2005)</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28068725" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28068725</a> - Aug 2021 (21 comments)<p><i>The Six Dumbest Ideas in Computer Security (2005)</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14369342" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14369342</a> - May 2017 (6 comments)<p><i>The Six Dumbest Ideas in Computer Security</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=12483067" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=12483067</a> - Sept 2016 (11 comments)<p><i>The Six Dumbest Ideas in Computer Security</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=522900" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=522900</a> - March 2009 (20 comments)<p><i>The Six Dumbest Ideas in Computer Security</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=167850" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=167850</a> - April 2008 (1 comment)<p><i>The Six Dumbest Ideas in Computer Security (2005)</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35811" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35811</a> - July 2007 (2 comments)
评论 #34514588 未加载
评论 #34516811 未加载
tptacek超过 2 年前
A reminder that a big part of the subtext of this piece is a reactionary movement against vulnerability research that Ranum was at the vanguard of. Along with Schneier, Ranum spent a lot of energy railing against people who found and exploited vulnerabilities (as you can see from items #2, #3, and #4). It hasn&#x27;t aged well.<p>I&#x27;m not sure there&#x27;s anything true on this list that is, in 2023, interesting; maybe you could argue they were in 2005.<p>The irony is, Ranum went on to work at Tenable, which is itself a firm that violates most of these tenets.
评论 #34516496 未加载
评论 #34519214 未加载
评论 #34521433 未加载
评论 #34515442 未加载
评论 #34516396 未加载
评论 #34519017 未加载
评论 #34515457 未加载
bluedino超过 2 年前
This describes the security industry as a whole.<p>We had a user click an email and get phished.<p>We tried training the users with tools like KnowBe4, banners above the emails that say things like THIS IS AN OUTSIDE EMAIL BE VERY CAREFUL WHEN CLICKING LINKS. Didn&#x27;t help.<p>The email was a very generic looking &quot;Kindly view the attached invoice&quot;<p>The attached invoice was a PDF file<p>The link went to some suspicious looking domain<p>The page the link brought up was a shoddy impersonation of a OneDrive login<p>In just minutes, the users machine was infected, it emailed itself to all of their Outlook contacts...<p>So this means nothing in this list detected a goddamn thing:<p><pre><code> Next-generation firewall AI-powered security &#x27;MACHINE LEARNING&#x27; &#x27;Prevent lateral spread&#x27; enterprise defense suite with threat protection and threat detection capabilities designed to identify and stop attacks AV software that was advertised to &#x27;Flag malicious phishing emails and scam websites&#x27; &#x27;Defend against ransomware and other online dangers&#x27; &#x27;Block dangerous websites that can steal personal data&#x27; the cloud-based filtering service that protects your organization against spam, malware, and other email threats </code></pre> And the company that we pay a huge sum of money to &#x27;delivers threat detection, incident response, and compliance management in one unified platform&#x27; didn&#x27;t make a peep.<p>But, we are up to the standards of quite a few acronyms.<p>It&#x27;s all a useless shitshow. And plenty of productivity-hurting false flags happen all the time.
评论 #34517999 未加载
评论 #34518026 未加载
ufmace超过 2 年前
I wonder how well we all think this article has aged?<p>&quot;Penetrate and Patch&quot; is supposedly dumb. But what do we practically do with that? We&#x27;ve seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what&#x27;s there to do but patch it? If some software has never had a bug found in it, does that actually mean that it&#x27;s secure, or just that no skilled hackers have ever really looked hard at it?<p>Also web browsers face a constant stream of security issues. But so what? What are we supposed to do instead? Any simpler version doesn&#x27;t have the features we demand, so you&#x27;re stuck in a boring corner of the world.<p>&quot;Default Permit&quot; - nice idea in most cases. I&#x27;ve never heard of a computer that&#x27;s actually capable of only letting your most commonly used apps run though. It&#x27;s not very clear how you&#x27;d do that, and ensure none of them were ever tampered with, or be able to do development involving frequently producing new binaries, or figure out how to make sure no malicious code ever took advantage of whatever mechanism you want to use to make app development not terrible. And everyone already gripes about how locked-down iOS devices are, wouldn&#x27;t this mean making everything at least that locked down or more?
评论 #34514696 未加载
评论 #34514654 未加载
评论 #34514605 未加载
评论 #34514577 未加载
评论 #34514849 未加载
bartread超过 2 年前
&gt; #4) Hacking is Cool<p>As an old I strongly object to the corruption of the terms &quot;hacking&quot; and &quot;hacker&quot; in the diatribe following this heading. I&#x27;m a fan of hacker culture, in the old sense, and encourage our developers to adopt a hacker mindset when approaching the problems they&#x27;re trying to solve. Hacking <i>is</i> cool.
评论 #34516232 未加载
donatj超过 2 年前
&gt; Wouldn&#x27;t it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?<p>That’s like saying “Why don’t they just design locks that are unpickable?”<p>They’ve been working on that, for a while. But you need to know what you’re protecting against. Anyone who watches The Lock Picking Lawyer knows about the swaths of new locks vulnerable to comb attacks - a simple attack that had been <i>solved</i> for almost a hundred years but somehow major lock manufacturers forgot about.<p>You can’t build something safe without considering potential vulnerabilities, that’s just a frustratingly naive thing to say.
评论 #34517299 未加载
superkuh超过 2 年前
Back in 2005 the idea that you shouldn&#x27;t run every bit of executable code sent to you was drilled into people. Nowadays you can&#x27;t use a commercial&#x2F;institutional websites without doing the modern equivalent of opening random email attachments.
评论 #34514811 未加载
评论 #34514681 未加载
Animats超过 2 年前
(2005)<p>&quot;Default Deny&quot; was, for a while, called &quot;App Store&quot;. However, the app store vendors have done much better at keeping out things for competitive reasons than at keeping out things for security reasons.
edrxty超过 2 年前
Looking back on that era, the hate towards hackers feels really misplaced. Yeah, at the time it was more local and more dominated by people doing it for the lolz but we kinda owe them a debt of gratitude. If they hadn&#x27;t gotten everyone to stop being lazy about security we&#x27;d be in a very different place now, surrounded by rouge states and agencies launching hyper sophisticated attacks on infrastructure and data. That was also the era that trained the current generation of cybersecurity experts.
评论 #34517949 未加载
sweetjuly超过 2 年前
&gt;Wouldn&#x27;t it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?<p>Sure, but how does one get the knowledge on how to secure systems? Half the job of a security engineer is thinking like an attacker and trying to poke holes in it. Key mitigations like ASLR and stack canaries are so effective because they specifically block off key resources and techniques that attackers use. It would be downright impossible to invent these mitigations (or even meaningfully understand them) if you did not already have a firm grasp on memory corruption and ROP. I&#x27;m not sure it&#x27;s an argument I actually care to defend, but I do honestly believe that you can&#x27;t be a strong security engineer if you don&#x27;t have a grasp on the techniques your adversaries use.
评论 #34514949 未加载
评论 #34514757 未加载
评论 #34514682 未加载
评论 #34515471 未加载
lmm超过 2 年前
Not convinced these are the dumbest (none of them is quite as dumb as requiring special characters in passwords, for example, and I&#x27;m not sure the fourth is dumb at all), or that they&#x27;re six ideas. The first two are the same, and the third one is a special case of the same thing.
评论 #34514165 未加载
评论 #34514478 未加载
评论 #34514243 未加载
saghm超过 2 年前
It&#x27;s super interesting to read this list as someone young enough that the first time I was ever prompted to consider computer security was in a college course almost a decade after this was written. Although different terminology was used, some of the ideas, like &quot;Default Permit&quot; and &quot;Enumerating Badness&quot; were so heavily discouraged when I first started studying that it&#x27;s almost hard to imagine them being considered good practice so recently before (although even today they&#x27;re common enough that it&#x27;s still worth calling out, so maybe this wasn&#x27;t uncommon knowledge at the time either). On the other hand, the next two ideas, &quot;penetrate and patch&quot; along with &quot;hacking is cool&quot; certainly don&#x27;t seem to be as reviled as the author would like, and I don&#x27;t think that the latter was a dead idea within a decade like they suggested. Trying to interpret them charitably, I could believe that the intention here was to decry the lack of proper threat modeling that was done in advance at the time (which still is a real issue today). On the other hand, reading it at face value sounds like the idea that if you think enough in advance and just &quot;don&#x27;t write bugs&quot; that your product will be 100% secure and never need any patching, which I don&#x27;t think is a good take. I&#x27;d counter that it&#x27;s essentially the same as the fallacy they mention later, &quot;We don&#x27;t need host security, we have a good firewall&quot;; proper design up front is a good &quot;firewall&quot; to stop bugs from coming in, but it&#x27;s not a substitute for having proper mitigations for when they do inevitably occur.
评论 #34514526 未加载
npteljes超过 2 年前
What I think happened is that with computing, humanity began to build a new world, a Different World that&#x27;s not like the other, old world outside. But since humans were building it, it became just like that. It has the same buildup, the same issues, the same dumbness as the original, real world.<p>#1: Default permit: people don&#x27;t like to spend energy, especially not upfront. Integrating &quot;Permit by default&quot; systems is much faster than setting them up with proper authentication, authorization and access rights. Permit default just works, starts quickly, and works fast.<p>#2: Enumerating badness: you mean, like how we name every single strain of viruses? So now we enumerate computer badness too.<p>#3: Penetrate and patch: very similar to how our laws work, I think. There are people who create injustises, and later the legal code is upgraded to handle that. Again, reactive, like in #1.<p>#4: Hacking is cool - well, other criminals are cool too, like pirates and maffiosos, and so on. People are drawn to power.<p>#5: Educating users: someone has to, doesn&#x27;t they, if they haven&#x27;t learnt the thing by themselves? You can&#x27;t make everyone go away if they are dumb, if you need them.<p>#6: Action is Better Than Inaction: This one, I think, imitates business. There&#x27;s a lot of ways to make money in business, and being there early is one of them.<p>That said, I really enjoyed the article. Permit by default is especially dumb, it was really funny when mongo installed itself with no password and listen on public IP, default port. And how long it took them to patch that. And how that haven&#x27;t burned the public goodwill! So maybe these things are not really dumb after all?
评论 #34521067 未加载
marcus0x62超过 2 年前
&gt; A few years ago I worked on analyzing a website&#x27;s security posture as part of an E-banking security project.<p>Cool, so a pen test?<p>&gt; One of the best ways to discourage hacking on the Internet is to ... pay them tens of thousands of dollars to do &quot;penetration tests&quot; against your systems, right? Wrong! &quot;Hacking is Cool&quot; is a really dumb idea.<p>...<p>Most of these are well thought out and still relevant 17 years later. #4 -- particularly the &quot;don&#x27;t learn offensive security skills as a defender&quot; idea -- was dumb in 2005, and its dumb now. Its also, unsurprisingly, not advice the author has himself followed.
bryanrasmussen超过 2 年前
I feel let down as a Dane that neither NemID or MitID deserve a mention.<p><a href="https:&#x2F;&#x2F;www.nemid.nu&#x2F;dk-da&#x2F;om-nemid&#x2F;historien_om_nemid" rel="nofollow">https:&#x2F;&#x2F;www.nemid.nu&#x2F;dk-da&#x2F;om-nemid&#x2F;historien_om_nemid</a><p><a href="https:&#x2F;&#x2F;www.borger.dk&#x2F;internet-og-sikkerhed&#x2F;mitid" rel="nofollow">https:&#x2F;&#x2F;www.borger.dk&#x2F;internet-og-sikkerhed&#x2F;mitid</a><p>full disclosure - I worked on the JavaScript implementation of NemID. My problems with it are not the implementation, but the whole concept.
评论 #34517665 未加载
deafpolygon超过 2 年前
&gt; but the second version used what I termed &quot;Artificial Ignorance&quot; - a process whereby you throw away the log entries you know aren&#x27;t interesting. If there&#x27;s anything left after you&#x27;ve thrown away the stuff you know isn&#x27;t interesting, then the leftovers must be interesting. This approach worked amazingly well, and detected a number of very interesting operational conditions and errors that it simply never would have occurred to me to look for.<p>As a sysadmin, I took this approach as well. On the local machine, the server(s) would log normally. But, when I set-up centralized logging, I set-up a list of log entries that wouldn&#x27;t normally interest me day-to-day. The server would only send to a central logging server things that weren&#x27;t on this list. What was left were usually problems that I would need to pay attention to and they got fixed faster.<p>The rest of the uninteresting log entries would just be audited from time to time.<p>On the matter of security, every user that logs in on a daily basis gets logged with their IP address. Anytime that a user logged in with a different IP - it would get logged to the central log server and I would be notified. Most of the time, it was harmless.. but there were enough times I would find a compromised account in a sea of normal day-to-day login activity.<p>When your logs are full of normal things in it, it&#x27;s easy to miss important details.
评论 #34516243 未加载
mcqueenjordan超过 2 年前
I agreed with much of the article and points made. Maybe I&#x27;m missing something (if so, would love to learn!) but I felt that the &quot;Penetrate and Patch&quot; section was a little naive.<p>e.g.<p>&gt; Let me put it to you in different terms: if &quot;Penetrate and Patch&quot; was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years?<p>I agree with the point that &quot;Penetrate and Patch&quot; shouldn&#x27;t be the primary strategy, but the author seems to write it off entirely with a viewpoint like &quot;you should just write software and build systems that don&#x27;t have security bugs&quot;. Well yes, of course that would be nice, but that&#x27;s not feasible. And some software is much more difficult to get right than other kinds.<p>&quot;Penetrate and Patch&quot; is a useful piece of security in that (a) it can catch what slips through the cracks, (b) it provides a sort of incentive mechanism to get it right in the first place, and (c) it simply isn&#x27;t possible to build bug-free systems.<p>The author claims that &quot;Penetrate and Patch&quot; finding bugs every month as evidence that it&#x27;s bad, but isn&#x27;t it the opposite? You cannot be bug free, so in fact any incremental progress&#x2F;fixes is in fact good.<p>All that said, I do agree that all of this starts with secure by design. &quot;Penetrate and Patch&quot; isn&#x27;t a good primary strategy and cannot replace Doing It Right. But I think it complements it well.
评论 #34514671 未加载
评论 #34514795 未加载
ghostpepper超过 2 年前
According to Slashdot this article was online since at least September 2005.<p>I would be interested to hear the author&#x27;s thoughts on what has changed in the 18+ years since it was written.
评论 #34514244 未加载
scotty79超过 2 年前
&gt; My prediction is that the &quot;Hacking is Cool&quot; dumb idea will be a dead idea in the next 10 years.<p>That didn&#x27;t age well. In the era of growing corruption in government and business alike hacking becomes important way through which people can actually learn anything about their overlord&#x27;s shady deals.
xkcd-sucks超过 2 年前
How about &quot;our users can&#x27;t tell the difference between a DOS attack and us having screwed something up&quot; plus &quot;the people that want to sue us for sucking are at war with the people that want us to look successful to get a promotion for hiring good vendors&quot; etc.<p>&#x2F;enterprise
mikewarot超过 2 年前
&gt;The real question to ask is not &quot;can we educate our users to be better at security?&quot; it is &quot;why do we need to educate our users at all?&quot;<p>Great point, but the emphasis on system administration instead of the broken nature of operating systems causes the point to be missed.
nokcha超过 2 年前
&gt; #4 ... &quot;Hacking is Cool&quot; is a really dumb idea.<p>This has aged poorly; nowadays, the most notable attacks are conducted by state actors (e.g., Russia and China) or for-profit criminal groups (e.g., ransomware) rather than lone hackers doing it for fun.
jojobas超过 2 年前
I guess this man&#x27;s internet heaven is filled by lobotomized users who can only exchange emails with a list of approved correspondents and browse only whitelisted websites. He, of course, gets to approve the lists.
adql超过 2 年前
&gt; One of the best ways to get rid of cockroaches in your kitchen is to scatter bread-crumbs under the stove, right? Wrong! That&#x27;s a dumb idea. One of the best ways to discourage hacking on the Internet is to give the hackers stock options, buy the books they write about their exploits, take classes on &quot;extreme hacking kung fu&quot; and pay them tens of thousands of dollars to do &quot;penetration tests&quot; against your systems, right? Wrong! &quot;Hacking is Cool&quot; is a really dumb idea.<p>That&#x27;s like, entirely unrelated. Black hats are motivated by monetary gains, not scout badges. The proliferation of internet made &quot;for fun&quot; hackers minority and irrelevant factor (or benefit, as they might actually report a bug instead of sow mayhem) when it comes to security.
评论 #34515246 未加载
评论 #34515466 未加载
amelius超过 2 年前
My favorite dumbest idea: autorun.<p>But of course, the dumbest idea in computer security is that it always comes last on the budget list.
fatih-erikli超过 2 年前
Penetration testing probably is the dumbest. You will not be sure if it is an honey pot or a real security vulnerability.
tsukikage超过 2 年前
&gt; A better idea might be to simply quarantine all attachments as they come into the enterprise, delete all the executables outright, and store the few file types you decide are acceptable on a staging server where users can log in with an SSL- enabled browser<p>An odd suggestion in an otherwise relatively uncontroversial article. It implicitly trains your users in a bunch of unpleasant things:<p>* clicking on some URL in an email, typing your password into whatever webpage pops up, downloading the blob it serves you and opening it (after clicking through the browser&#x27;s &quot;this was downloaded from the internet, are you sure?&quot; warning) is a perfectly normal and legitimate part of the working day<p>* one needs to find ways to obfuscate documents of types that aren&#x27;t on the IT whitelist so one can send them to one&#x27;s colleagues so they can do their jobs (and no, the corporate whitelists <i>never</i> capture everything people urgently need to share in order to do their jobs)<p>* since everyone now does that habitually, receiving an automangled email with a link to an attachment which has its actual payload contained in several layers of archive obfuscation wrapper is perfectly normal because that&#x27;s just what you have to do to share stuff with your colleagues now<p>These could, of course, be mitigated by suitably educating users, but since the practice is advocated in a section about user education never working, that is unlikely to happen.
评论 #34517522 未加载
scotty79超过 2 年前
&gt; Wouldn&#x27;t it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?<p>How can you engineer a good lock without investing all the ways it can be bypassed by lockpicking lawyer?
nibbleshifter超过 2 年前
That hasn&#x27;t aged well, at all, lol.<p>The first two points are alright, then it just veers off the rails
评论 #34516321 未加载
plaguepilled超过 2 年前
I like some of this, but &quot;enumerating badness is a bad idea&quot; is just wrong. Quantifying errors is an important part of tracking progress in software work.<p>Its the same as any other project in life: you track mistakes and address them.
quickthrower2超过 2 年前
User education is not dumb. Services that send test phishing emails and check that people mark them as such are a good idea. It gets people used to receiving suspect emails and dealing with them.
评论 #34515219 未加载
cmdialog超过 2 年前
Sorry guy who wrote this article in 2005, hacking is definitely cool.
gnu8超过 2 年前
The clown who wrote this thinks the word hacking means cracking. That automatically negates everything he says. I would not take anything in this article seriously.
AtlasBarfed超过 2 年前
I think this misses two or three big points:<p>1) Offer solutions not process&#x2F;procedure:<p>Devs want to make secure systems, but they have VERY LIMITED TIME. Security is always something that is #1 in the bullet points of a presentation of priorities, and always a distant priority in the boots on the ground of features and keeping shit running.<p>What I&#x27;ve noticed is that the security team doesn&#x27;t want to be responsible for cleanup or doing lots of work or engineering. They want to make presentations for the upper management, pick some enterprise partners to impose on the orgs, and kick back in offices. Most know little about cryptography or major incidents. If a great security practice like &quot;sync ssh keys&quot; or other things that may require a bit of legwork, they don&#x27;t want to do it.<p>They&#x27;d rather load down the devs. They&#x27;d rather come in and review the architecture rather than provide drop-in solutions. If something needs customization for interface with SSO or getting credentials, they drop the integration in the devs laps. Who&#x27;s supposed to be the experts here? The security team should own whatever craptastic enterprisey shit they select, and ALSO be responsible for making it useful to the dev org.<p>The biggest example of this is the desire for &quot;minimum permission&quot;. Take AWS for example with its explosive number of permissions, old and new permissions models, and very complicated webs of &quot;do I need this permission&quot; and &quot;what permission does this error message mean I&#x27;m missing&quot;. And ye gods, the dumb magic numbers in the JSON, but anyway. If the security team wants AWS roles with &quot;minimum viable permission&quot; THEY need to be experts in the permission model and craft these VERY COMPLICATED permission sets FOR THE DEVS. And if the Devs need more, they need to very quickly provide (say &lt; 1&#x2F;2 day) new permissions in case some new S3 bucket is needed or some new AWS service is needed. But security teams don&#x27;t want to do such gruntwork.<p>2) recognize that automated infrastructure is the rule, not the exception, aka the devs are not the enemy<p>It took sooo long for ssh keys to become prevalent in development that people weren&#x27;t ssh&#x27;ing in using passwords. Like, decades. This practice represented a big leap in administration productivity and probably was more secure.<p>And you could automate on top of it in shell scripts, not leave passwords in .history, lots of good things.<p>And the security industry wants you to undo it. Wants TOTP passwords from your phone hand-typed, wants a web page to pop up to gain temporary credentials, pretends you know how long your process will run so those temporary credentials won&#x27;t expire and if you do, what, you&#x27;re supposed to manually re-authenticate?<p>Security at my last job wanted an ssh replacement to be used (the enterprise security industry is waging war on ssh&#x2F;sshd) that if I used it from the command line IT POPPED UP A BROWSER PAGE. And no way to automate this for any task.<p>In general security teams seem obsessed with making devs lives as hard as possible. Are most leaks via dev channels? In my experience the BIG leaks are &quot;County Password Inspector&quot;, phishing, disgruntled&#x2F;angry employees selling access. Well, and credentials checked into github. Most places I&#x27;ve worked at have involved this steadily slide into less and less usability by the devs, at GREAT cost to productivity, for questionable payoff in actual platform security.<p>Meanwhile, no joke, ssl protocols on internal password reset sites were using such poor algorithms that Chrome was refusing to display it. Githubs were open to the public that shouldn&#x27;t have been. 8-character limit passwords with proscribed character usage.<p>Nuts.
EVa5I7bHFq9mnYK超过 2 年前
Isn&#x27;t the author Enumerating Badness in that article?
评论 #34520110 未加载
Pengtuzi超过 2 年前
Regarding<p>&gt; 6) Action is Better Than Inaction<p>I’m a fan of the<p>&gt; don’t just do something, stand there!
msla超过 2 年前
&gt; &quot;We can&#x27;t stop the occasional problem&quot; - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn&#x27;t think so.<p>This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That&#x27;s why they have:<p>* checklists and inspections, to catch them beforehand<p>* communications, to catch them while they&#x27;re evolving<p>* redundancies, to turn ramified problems nobody caught into annoyances instead of disasters<p>No matter how some people whine and moan, &quot;Just Be Perfect&quot; fails to be an actionable plan.<p>Also: Hackers will be cool as long as DRM and planned obsolescence&#x2F;designed-in insecurities exist.
评论 #34514501 未加载
评论 #34514517 未加载
评论 #34514459 未加载
评论 #34515198 未加载
评论 #34514479 未加载
评论 #34514493 未加载
评论 #34514549 未加载
评论 #34514996 未加载
评论 #34516365 未加载
评论 #34514472 未加载
评论 #34515459 未加载
FatActor超过 2 年前
No billion dollar company is anywhere near as glib has the author makes them out to be. Maybe my experience varies, but the European companies I&#x27;ve worked with have strict cybersecurity liability, and they take every aspect of security seriously and do not just pat themselves on the back smugly, as OP portrays. Maybe this was the case in the 90&#x27;s, but it sure is not the case today.<p>EDIT: I deleted most of my post because I found it was repeated up and down the comments which I am so relieved to see. I kept my post because I want newcomers to hear as many voices in objection to OP&#x27;s outdated essay as possible.
评论 #34515477 未加载
m463超过 2 年前
If I could come up with one dumb idea it would be something like:<p>You can trust <i>large-organization</i> to secure your device.<p>(especially for orgs that give themselves, advertisers or apps more access to the device than you have)
评论 #34514633 未加载
评论 #34514273 未加载
scotty79超过 2 年前
&gt; My prediction is that in 10 years users that need education will be out of the high-tech workforce entirely, or will be self-training at home in order to stay competitive in the job market. My guess is that this will extend to knowing not to open weird attachments from strangers.<p>And yet, just yesterday I&#x27;ve seen a TV ad explaining how to not get phished out of your money through your banking app.<p>I think it a running theme in this document that author displays severe lack of understanding how security becomes hard as soon as you let anyone do anything online.
评论 #34515445 未加载
评论 #34515474 未加载
scotty79超过 2 年前
&gt; #1) Default Permit<p>I guess author of this post is no longer with us because they got heart attack when npm and similar rose to prominence.
评论 #34516823 未加载
评论 #34515455 未加载