Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3129

Re: Is computer security culture simply broken?

Show key headers only | View raw

On 2014-05-25, Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 5:13 PM, Randy Westlund wrote:
>> On 2014-05-25, David Harmon wrote:
>>> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
>>> <rsw@therandymon.com> wrote,
>>> >From the «type loudly so the NSA can hear you» department:
>>>> Title: Everything is broken
> As you say, it's not hard, but storing plain text passwords is the
> obvious approach, and unless the developer has the time and motivation
> to research the matter, to discover the issues and possible solutions,
> plain text is what you get. Take someone fresh out of university, and
> give them the task under time pressure, and it's easy to see how these
> things happen.
>
> So far as I'm aware, no one has yet been seriously sued over this kind
> of thing. Until they are, I doubt we'll see much change.
>
>
> Sylvia.

Putting on my economist hat, I think it has something to do with screwed
incentives.  Take six starving young CS graduates, stuff them in a
creative space in San Francisco, give them each a Macbook Pro, and set
the timer.  They've got huge ambition, limited time and energy, and a
hugely competitive, shark-filled marketplace.  The goal is to put
together some kind of web service that is so unique, useful, and
appealing, that it becomes trendy and then essential to use.  Then Apple
or Google buys you out (ha ha, not Microsoft! Those days have passed!),
and you live happily ever after in your nouveau-riche geek lifestyle.

So clearly: you focus your time and energy on features and usefulness,
and security - the essential but boring and largely invisible part no
one cares about unless something has gone wrong, and nobody notices if
you do it correctly - goes totally forgotten, or at a minimum,
deprioritized.

It's like the open source phenomenon where everyone wants to work on the
new theming engine, but no one really wants to work on the low level
messaging subsystem or file system abstraction, because it's not sexy
enough.  And absolutely no one wants to fix annoying bugs, as that's not
sexy, fun, or interesting in the slightest.  Security goes on that list,
too.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web