Bad Security Driving Out the Good 215
Bruce Schneier has up at Wired a typically thoughtful piece on how, in the security market as in others, the lemons are winning out over the good products. Schneier harks back to "The Market For Lemons," the 1970s work of economist George Akerlof, to explain why the market's invisible hand pushes most of the best products into the abyss: "With so many mediocre security products on the market, and the difficulty of coming up with a strong quality signal, vendors don't have strong incentives to invest in developing good products. And the vendors that do tend to die a quiet and lonely death."
The way of the world (Score:5, Insightful)
Re:The way of the world (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:The way of the world (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
Stock market (Score:3, Insightful)
Tech Guys should learn from Marketing. (Score:2)
The best Marketing = Religion (Score:5, Insightful)
Endless promotion, Endless recruitment, Constant attack on competition.
Persuasive spokespersons, Constant reminders of what you WONT get if you dont buy, and buy NOW.
An answer to every question or challenge about your product, and when that wont work, promote FAITH in the organization, and patience in the reciept of what you are really wanted.
Unashamed, unabashed belief in your product as THE ONLY real solution.
This is Evangelism, and it works better than anything else, regardless of whether you really have the goods or not.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You mean it's God himself, and not St. Peter?
(But seriously, I would be more surprised to see someone come back from the dead. How would you do that? Your body is a rotting corpse, or even probably cremated... Your brain-functions are dead too. You're dead!)
Re:The way of the world (Score:4, Insightful)
The problem is not just marketing. The problem is that since buyers aren't well-informed, they choose mediocre products, which prices out the best products. This starts a nasty cycle, since with the best products out of the market, buyers then choose even poorer solutions to save a buck, which ends up pricing out the best remaining products, and so on.
Marketing takes advantage of asymmetrical information -- but the root cause is the buyer's lack of information. Given that most decision-makers do not have the resources to adequately research every purchase they make, how can this be fixed? How much should a company spend on researching products, in relation to the cost of those products? Many people can't justify spending a lot of time researching the options for a $2000/yr solution. When the proposals come in, and several[1] of the vendors offer a seemingly-equivalent solution for $1500, how can I justify spending $2000? Purchasing is about choosing products that meet your requirements at the lowest cost. It's not feasible for every purchase to undergo a full TCO analysis that includes factored risk of loss -- how many businesses employ actuaries?
Multiply this scenario by thousands, and the best solutions are driven out of business.
[1] It's important that there are multiple options at that price point, since it makes each of the products at that level seem acceptable.
Re: (Score:3, Insightful)
Security is one of the few cases where we're supposed to pay more to inconvenience ourselves. I'd say most people outside of the small fraternity of computer security folk would really prefer the insecure product, until its consequences hit them.
D
Re: (Score:3, Insightful)
What consequences? You talk like something gruesome is going to happen to anyone that loses data. But for most of us, it's just an inconvenience. Old budgets and technical stuff with zero interest for anyone outside the project. If someone finds it, he's probably going to delete it and fill it up with mp3's instead.
Besides, relying on encryption, because
Re:The way of the world (Score:5, Insightful)
While you are looking at marketing campaigns, see who spends the most money. I believe that the value of a product is inversely related to advertising dollars spent. With the exception of products that are new. VoIP is one of those (even though I can't for the life of me figure out what the Vonage marketers were thinking) exceptions where the product is so new that advertising is as much about education as it is selling. Sleeping aids and medicines for ailments your parents never heard of is no better than little blue pill junk mail. There are times that I think that such advertisements should be blockable and covered under the can-spam act.
Anyway, advertising sells. Without it consumers won't even know there is a product. Despite the buzz about desktop linux there actually are people in North America that do NOT know what Linux is, never mind if they want to use it. Security products and practices are the same. I haven't counted, but I know I don't have enough fingers for counting the number of times I've heard a VP spouting verbatim from some magazine article as if he learned it in college or something.
This effect is what keeps MS products so prominent, people don't actually know or understand that there are other competing products. People know about Mcafee and Norton. They don't know about ClamAV, and are not sure what Symantec does.
The open market, in this respect, is just a popularity contest.
I had hopes that sites like Consumer reports et al would change that, but no, consumers really are mostly sheep.
Re: (Score:2)
Wrong. There is not buzz for linux outside of technologists, because the benefits linux brings, are only recognizable to technologists. The average user isn't going to care about open source unless he understands how to program. The average user isn't going to care about better technical solutions, unless they are glossed over by a facade as pretty as windows. And the average user sure as hell won't accept
The way of the ignorant. (Score:2)
Marketing and persuasion always wins out in the end.
Only if the marketers can suppress truth, but that's very expensive and fails eventually. If you look at Microsoft's quarterly statements you will see that they spend about a billion dollars a month on marketing. Some good examples of their failures are webTV, IE, Zune, Plays for Sure, Bob, ME and now Vista. Not only did M$ blow a much of money shouting about these things, they have done a lot to sabotage their competitors efforts. Yet all of these
Re: (Score:2)
This hasn't been true, for the most part, since the early 1900s. Yes, before TV and commercial radio.
A marketer's job is to make people want the product or service. They don't care what the consumer actually wants or needs. Their job is to manipulate people into wanting things they wouldn't normally want or ne
marketing (Score:4, Insightful)
Re:marketing (Score:4, Informative)
My parents both wish to learn more but they just don't understand what thinks mean. They think "memory" (RAM) is used to hold data (Hard drive space), so getting more RAM must mean they can store more files. Logically this works, memory = storage in the classic sense and this is why marketing works. Saying "More 255 QUQUTALUU memory!" and "wow a massive 20 gig hard drive" makes it seem like these things are big and impressive, where as people who know see it's complete crap.
Maybe if we stopped calling people lazy and taught them just the basics (what RAM does, what a hard drive does etc.) they would understand marketing for the bullshit it is and see through it. But instead we sit here going "lol idiots, too lazy! idiots!" and end up having to slave over their mistakes.
Re:marketing (Score:4, Insightful)
Re: (Score:2, Insightful)
Computers are complicated, esp. security (Score:2)
For everyone else, it's a magic black box. They know files are kept in there
Re: (Score:2)
I agree with you to a certain extent, but let's face it -- no one can be a "Renaissance Man" (or woman) any more -- there just isn't time. That's why we have a division of labor -- so that you can do what you
Re: (Score:2)
This is true, but it's also an overused lame excuse for being ignorant.
Sure, you can't know everything - but that doesn't mean that you shouldn't know the difference between a bit and a byte, a chainsaw and a drill press, a cell and an organ, an oak tree and a pine tree, limestone and granite, diesel fuel and gasol
Your point is valid, but... (Score:2)
There's no reason to be condescending.
In most cases, the difference between value of the "best" product and its competitors is less than the time/money cost of determining which is indeed the "best".
Re: (Score:2)
Money. (Score:5, Insightful)
Re:Money. (Score:5, Informative)
The best understatement of the year so far? (Score:5, Informative)
Vista (Score:5, Insightful)
(Yeah I know... flamebait. But it had to be said.)
Re:Vista (Score:5, Insightful)
On Topic: Is this really a "bad security winning out" scenario, or are we merely looking at the triangle of cost, security and usability... cost and usability are of course the big factors for most corporations, so the sacrifice of security is, perhaps, merely a progression of cost cutting and the aim to supress those "annoying messages" that indicate a potential PEBKAC when inputting data.
My $0.02 AU
Vista is selling? (Score:2)
[market for lemons] explains why Vista is selling.
It would if Vista was selling. I have not seen any evidence of that so far, other than channel stuffing. The word from local stores is that people who make the mistake of installing Vista hate it enough to buy XP and pay someone to put it on. They have to buy another copy of XP because Vista upgrades won't give back their license to run XP or they had no choice about OS when they bought a new computer. I'd say Vista was failing badly and it's hurting
Re: (Score:3, Interesting)
I'd say Vista was failing badly and it's hurting computer sales.
Well... Mac sales in the U.S. are up 30% over last year [appleinsider.com].
The winners are never the best. (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:The winners are never the best. (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This story 2400 years old. (Score:5, Insightful)
Re:This story 2400 years old. (Score:5, Interesting)
Children no longer obey their parents, every man wants to write a book,
and it is evident that the end of the world is fast approaching."
--Assyrian tablet, c. 2800 BCE (allegedly)
Re: (Score:2)
Children no longer obey their parents, every man wants to write a book,
and it is evident that the end of the world is fast approaching."
--Assyrian tablet, c. 2800 BCE (allegedly)
I think something got lost in translation here. Or is a desire to write a book really a sign of the end times?
Re: (Score:2)
Based on the new publications at Barnes and Nobles I can see why someone might make the inference.
Re: (Score:2)
Heh, in our increasingly "post-literate" age it seems kind of odd.
Maybe a "truer to the spirit" translation would be "every man wants his own talk show"
It can still get worse. (Score:2)
Re: (Score:2)
Perhaps it is the Sumerians? They inhabited Mesopotamia at that time.
Matter of desire (Score:4, Interesting)
If on the other hand you spend the proper amount of time on security, and position yourself outside the market by the delay in time and additional cost, you lose.
Which is pretty much why OSS rules in terms of security. In the OSS world, we can afford to spend an extra month or two per release to make sure everyone is in order and decent procedures are followed. Which isn't to say it's always the case [most GAIM plugins are horribly written] but usually more often than not it is with things like GPG, OpenSSL, OpenSSH, etc...
Tom
Re: (Score:2)
It's just that we're not trained with respect to security. We have come to take it for granted. So far our model for security has been physical security, and we pretty much have been able to take it for granted. Violations of that assumption are pretty rare and shocking, and the common use of those 2 adjective for that situation validate the assumption.
Now take a different location where the assumption of physical security is not valid, such as Iraq or places in Africa. Most of us would just
Marketers are terrible. (Score:4, Interesting)
Re:Salesmen are terrible. (Score:2)
Re: (Score:3, Insightful)
The problem, essentially
Re: (Score:2)
The "best" car might be (Score:2)
Secustick (Score:4, Funny)
Need a smarter, tougher market (Score:2)
Same in every market. (Score:2)
With security products, things become harder because there's no easy way to tell if it is working. If there's never an attempt to steal the data or hack the server, or if the attempt goes unnoticed, then it appears everything is working great.
Additional factor makes it worse for individuals. (Score:2)
When you make a security decision, it's usually a low-cost personal purchase. When it fails (say your identity gets stolen), the losses you might incur can greatly outweigh the initial investment in the technology, and you will little legal recourse against the vendor to make things right.
This is why I don't trust any commercial security produc
Tech companies just dont understand Marketing (Score:2)
If you build it, THEY WONT COME, unless you practically shove it down their throat, with associated information, pricing, positioning, comparisons and timing. Got that, Commodore?
Microsoft sells technology like
case in point (Score:2, Interesting)
I keep worrying they'll pounce on nod32 next.
Design and Evolution (Score:2)
As Microsoft Windows and the design of the optic nerve shows, it's not the best that succeeds, but the thing that's good enough.
Good vs Good Enough (Score:5, Insightful)
All things equal, people will choose good over good enough, however all things are not equal. Better products tend to cost more, better service costs more. Cheap products that do mostly marginal job wins the price war and hence wins the market.
There are always going to be niche markets that serve people who KNOW quality and service, most people don't care enough. They'll just choose whatever is cheapest at the moment from brands that they know (even if cheap), as long (and this is key) the quality is "good enough".
Which is why if I were making a product line, I'd make two different and distinct products, one "good enough" and one with better higher quality/service. I'd even go so far as to make sure by brand distinction that people would knwo "cheap, but good enough" from "good" by using strong branding.
Take McDonalds vs any higher quality hamburger shop (Red Robin, White Castle etc), which one is "good enough" vs good. Why don't more people choose the better burger?? It is because McDonalds is "good enough". And in spite of everyone complaining about McDonalds employee quality of service, it is "good enough" to keep going back.
Re: (Score:2)
Re: (Score:2)
It sucks because it is so wasteful.
Re: (Score:2)
http://www.redrobin.com/ [redrobin.com]
And I have no affiliation with them, other than I enjoy a good burger over "good enough". My favorite is the Banzai Burger. Yummm, Okay now I'm hungry.
Uh-oh "market failure"... (Score:2)
We have a Market Failure [wikipedia.org] here. Ergo, we need computer security controlled by the government — let's expand the Department of Homeland Security's duties one more time... Or, because we, the critics of the free market, hate the DHS (mostly because it was not us introducing it), let's create an entirely different entity instead.
Pre-emptive flamebaiting...
Yes, there is a government agency [wikipedia.org] looking into computer security, but their role, so far, has been advisory. An alleged "market failure" is usually
Re:Uh-oh "market failure"... (Score:4, Insightful)
Libertarians are the group most vehemently against this concept, but I have never heard a single one of them coherently explain how exactly the free market will remain free without regulation. Their arguments seem to boil down to "LALALALA I can't hear you! There's no such thing as market failure, the market is infallible!"
If you have a better argument as to why market failures aren't a problem, or a better solution than regulation if you think they are, I'd love to hear it.
Re:Uh-oh "market failure"... (Score:5, Interesting)
What people argue is that the free market is "good enough," and is a system that is so complex and quick to react, that any attempt to regulate it for its own good should be looked at long and hard -- simply because it's so difficult to do better without detrimental ramifications, even with the best of intentions.
Natural monopolies are a problem and environmental costs are a problem, and are good targets for regulation.
"Imperfect information" -- I don't understand where this idea got started, but it's completely wrong when applied to free markets. It has to do with zero-sum games like the bond market where there are definitely winners and losers -- here, the guy with the best information wins.
In a free market, when a transaction takes place, the idea is that both parties are better off than they were before. I make a piece of furniture to sell you, you buy it because you can't make as good a piece of furniture for as low a price. I make a profit, and you profit by using your time more efficiently. We both win, despite the fact that I'm a furniture expert and you don't know every detail about the construction of the chair I sold you.
In fact, it's precisely this reason, that you don't need to have perfect information to participate to your advantage, that the free market works.
No, it's not perfect, but it's the best we've got in a free society.
The real issue with imbalance of information (Score:3, Informative)
Sellers of used cars have more information about the true value of their car than buyers do. Therefore, buyers must assume that the car is of lesser value than the seller states. As a group, they will offer less than a fair value for the car. This drive
Re:Uh-oh "market failure"... (Score:5, Insightful)
In other words: "La la la la. I'm not hearing you". We've already saw how the free market behaves, and didn't like it. The deployed solution was regulation, and that made the situation better, but created a lot of problems itself. Can you put any other alternative on the table?
And imperfect information IS a problem. You enter a deal if you THINK you'll be better after than before it. What you think will happen doesn't have to resemble what will really happen, they just are the same thing if you have perfect information.
Re: (Score:2)
Market is not infallible. The libertarian argument is, it is less fallible than the vast majority of mechanisms designed to regulate it.
Even with the "sacred" things like FDA, it is unclear, if the number of lives preserved by the agency's weeding out bad medicines is greater, than that lost because of the immense regulatory burden faced by the pharmaceuticals.
Re: (Score:2)
I've come down hard on free market libertarian types in the past, but that has just been counterproductive. I'm now trying to figure out a way to build a socialist construct within a completely free market framework in a fair and non-coercive way. I'm interested in any ideas that anyone has about better and non-coercive ways of maintaini
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Lol. Libertarians are the first to tell you copyright and patents are anti-market devices. Don't be surprised by them doing what they preach.
Anyway, there's an article explaining in details [mises.org] why the books are being freely offered for download (excerpt below). It's an interesting reading on its own, and even more so for those who, not understanding what "free market" actually means, show the kind of misjudgment you expressed. Give it a try.
Computer Security - The Problem for Joe Blow (Score:5, Insightful)
Most people have no need of a USB key that self-destructs. They don't need to encrypt their hard drives, on which they probably store nothing more sensitive than their really bad first novel draft. They don't need a 26 character Hex password on their operating system. I suspect that a much higher percentage of these normal people lose their data because they can't remember the password to access the data than lose it due to not having tight enough encryption protection. They are out there having to reformat their drive because they can't remember their login password, or having their laptop explode because they installed the new "Explodo-Crypt" device and then accidently had the caps lock key on when they tried to access it.
People need to get effective security solutions for their REALISTIC needs.
Re: (Score:2)
Re: (Score:2)
Forget user education. This is a great example of what "user education" leads to - it is quickly turned into a marketing machine.
Re: (Score:2)
I've often wondered how much security exactly is lost if the password systems would just allow a case inverted pASSWORD, and warn the user if the password was typed in ALL CAPS. (Some keyboards put everything in caps when caps lock is even if you press the shift key, some invert the sense of the shift key) Thus if the user's password is aLt256!, the system would allow AlT256!, and warn about ALT256!.
If your password system has billions o
Re: (Score:2)
Yet, the second group still needs backups. And I doubt they do it.
Security at all the places I worked. (Score:2)
Maybe if the people in charge of it weren't there as a punishment...
Smoking Mirrors Dominate (Score:2, Interesting)
4 problems with IT security (Score:2)
5 problems with IT security... (Score:2)
Maytag Washers (Score:5, Insightful)
It's because there's no financial incentive for a company to make good washing machines any more. The ones out there are rushed to market, made of inferior quality parts and put together poorly. If I have to buy a new one in 5 years, even better for the company that makes it. They get to sell me another one.
In the free-market economy, if I decided to make a 50 year washing machine, I'd have to compete with companies that are established in the market. My washer would necessarily be more expensive than a GE or Whirlpool, and nobody's ever heard of my company. On the off-chance some people buy it, realize that it's great and it gets a good reputation, I'm still faced with the fact that once everyone in the world has a 50 year washer, I'm out of customers until 2057. Now what?
I used Washing Machines as an example here, but it's true of nearly every consumer device out there. I'm not sure what the solution is, but I don't see it getting better any time soon.
Re: (Score:2)
I'll bet you could buy a 50 year, or at least a 25 year washing machine, but you'd have to import it from Scandinavia. It'd be made of stainless steel, and you'd have to replace the belts and sea
Re: (Score:2)
There's a lot of truth to that. Engineers used to design things with a fudge factor built in. Round things up to the next highest thickness part, and stuff like that, for a couple of reasons. Increased durability was one of them. Another was inexact manufacturing processes. Another was just not knowing exactly how thick something needed to be to last "the life of the product" whatever that was supposed to be. Computers affected 2 out of 3 of those reasons.
There is one other reason spec
Re: (Score:3, Insightful)
I ran into this with office furniture recently. Some desks that were quite well constructed needed to be gotten rid of because we didn't have space in the office. The responses I got were "I can buy a desk at Ikea for $100 and when it
Standards for security (Score:4, Interesting)
Most home door locks are terrible. The standard for them specifies that they should resist opening for 15 seconds with a screwdriver. Really.
The US Department of Housing and Urban Development used to have good standards for doors and locks in their housing projects. [hudclips.org] Every unit had a steel-sheathed fire door with a steel frame and locks that could resist serious abuse. In a building with interior walls of reinforced concrete, this provided quite good security. Which was needed.
I once saw a news video where some cops were raiding an apartment in a housing project. They show up at the door with a two-person battering ram, and bang away for a while. After about thirty seconds of banging, the cops are exhausted, and they try yelling through the door at the occupant to open the door. From inside, a sleepy voice answers "I can't. You broke the lock". The door held until they sent out for power saws.
Now that's how security should work.
Re: (Score:2)
Re: (Score:2)
Mount the steel door frame so that it floats on automotive valve springs. The springs are pre loaded to push the frame flush outside but with about three inches of travel towards the inside. That way, when rammed, the door gives and the masonry/conrete doesn't take the concentrated impulse of the ram. Apparently valve springs are quite stiff so that using several of them will absorb the energy of a very heavy ram.
This suggestion was published in one of those counter-culture Paladin
Re: (Score:2)
his dates are off (Score:3, Informative)
Why I like Bruce (Score:2)
Re: (Score:2)
Re: (Score:2)
The problem is that in order to have good security your product has to make a user or system do less, or have more of a management overhead. People don't like that, they'd rather have less trouble.
Not all security is a usability or functionality loss. For example, antivirus running in the background stops blacklisted binaries from running, but users don't want those binaries running in the first place so the functionality that is stopped is in line with what the user wants. I don't want a remote attacker to be able to log into my box and start up a spam server. Most users might not even know if this happened to them. Security that silently stops this from happening increases usability and users are