Internet Security: Where Do We Stand 219
buxton writes "The Economist is running an interesting story which overviews the current global situation on internet security in hackers, terrorism, worms & virii, Microsoft's 'monoculture', and a bunch of other interesting points. Some nice suggestions made by big names in the software industry have been included, such as creating more easily traceable methods of people (i.e. trying to eliminate online anonimity) as a method of preventing hackers. One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward."
How about we encourage people to use IPTables? (Score:4, Interesting)
With just IPTables and SpamCop configured properly most of these security problems disappear.
Re:How about we encourage people to use IPTables? (Score:5, Interesting)
Re:How about we encourage people to use IPTables? (Score:2, Insightful)
If you really cared about your grandmother enough that you feel it's necessary to hold her up as a debate spectacle on an internet discussion board then you would be more than happy to set up her system so that she doesn't need to worry about any of these technicalities.
Re:How about we encourage people to use IPTables? (Score:2, Funny)
Re:How about we encourage people to use IPTables? (Score:3, Informative)
Re:How about we encourage people to use IPTables? (Score:3, Insightful)
Yeah, it's just the rest of the OS that'll make Grandma likely to off herself in frustration and get you that inheritance early.
Grandma should probably stick to a Mac, I'd say.
Re:How about we encourage people to use IPTables? (Score:5, Interesting)
Of course, the things I presented here are only for a small percentage of all services and machines in "big" production environment. So, for more protection, a close look at the client has to be done, too.
Re:How about we encourage people to use IPTables? (Score:2, Funny)
I think this [techtales.com] sums it up.
Re:How about we encourage people to use IPTables? (Score:5, Insightful)
-
Isn't teaching people how to defend themselves using free open source software better than talking about the best way to start up a posse?
With just IPTables and SpamCop configured properly most of these security problems disappear.
The problem is most people don't want to deal with OSS if that means using Linux. They want to be able to use most of the software that they can find in most stores, share it with friends, etc. As much as I like Linux, I use Windows XP on my main system because I prefer a lot of windows-based tools to linux-based ones. (And this includes free/shareware, not just commercial software.)Before someone says it, WINE isn't the answer, not yet anyway. I'm an expert user, and I have troubles with getting things to work under WINE, or at least things I _want_, not just things that will. This is the deal-breaker for your average joes, they won't deal with it.
Besides, OSS software can be harder to secure right if you don't know what you're doing fully. I think the best approach all around is to hold companies responsible for glaring defeciences. If you have a bug/security hole found every once in a while it's one thing. When you have them found weekly, if not daily, and you have a closed-source product, then there's really no excuse for it.
Re:How about we encourage people to use IPTables? (Score:2)
Especially for home-user boxes, packet filters are of pretty little use. Before you block services from being accessed via the big bad internet, why do they have to listen on a public interface in the first place?
Anonimity necessary (Score:5, Insightful)
To quote an article [tomchance.org.uk] I wrote on this some time ago:
"During the Kosovo conflict in 1999, a sixteen-year old ethnic Albanian girl, nicknamed "Adona", began an e-mail correspondence with a junior at Berkeley High School, America. She wrote of Serbian forces holding her village to ransom, killing journalists and community leaders, raping women, and finally of her friends and family deserting the village
Because of the anarchistic, anonymous nature of the Internet, the Serbian authorities could do nothing to stop this flow of information between its citizens and the outside world, which meant that it could no longer censor all information. This not only gave the people of Kosovo who had some access to these Internet organisations hope and a sense of purpose during the conflict, but helped the international community better understand the circumstances in Kosovo during and after the conflict.
"
Re:Anonimity necessary (Score:5, Insightful)
In short, the problem is not the anonymity of these cyber-terrorists, it's the accountability-phobia of software firms, at the root cause of these breaches. If we had a law that a 'supplier' of software is bound to fix security breaches and vulns free of cost in his code, we'll suddenly see MS rewriting Windows from scratch for LongHorn.
The current law is like an alsatian without teeth.
-
Re:Anonimity necessary (Score:5, Insightful)
Re:Anonimity necessary (Score:2)
No, then you'd never see another version of Windows. Or Linux. Or Microsoft Office. Or OpenOffice. Or any mainstream software produced by anyone, ever.
Re:Anonimity necessary (Score:2, Interesting)
Internet security is only a problem due to serious flaws in the Windows model of bringing computer technology to the world. I don't feel that it has anything at all to do with any piece of legislature. The problem with internet sec
Re:Anonimity necessary (Score:5, Interesting)
Are you so niave as to not realise that in our increasingly totalitarian world, these are all detriments.
How do you think John Ashcroft feels about people who percieve the US as having an "overbearing government" being able to speak out anonymously and with impunity?
Hasn't he gone on record about his views on that?
And as far as whistle-blowers go; no corporation considers whistle blowing to be a Good Thing, and therefore if they were presented with that angle of online anonymity they would probably pony up Even More Money to fight it.
So, in short, the reasons you cite are the reasons why online anonymity is now a thing of the past.
Re:Anonimity necessary (Score:2)
Re:Anonimity necessary (Score:2)
Any evidence?
What about Europe? What about China? What about Japan? What about South Africa? What about many South American nations? They all seem to stand out as exceptions to this maxim of yours.
Re:Anonimity necessary (Score:2, Interesting)
That very email conversation with the 16 year old Albanian girl could have really taken place with a 54 year old Brooklyn man (posing to be the girl of course), how would you know without some sort of identit
Re:Anonimity necessary (Score:2, Insightful)
Communication works when it can be attributed to a known individual or institution. Judgments can then be made by past direct or indirect involvement with those parties. While it certainly true that anonymous communication protects certan parties from certain other parties that wish
Responsibility necessary (Score:2)
OK, let's suppose for a moment that all Internet activity is traceable under judicial supervision by the legal authorities, and no-one else.
Now, the following people will have to take responsibility for their actions, and one way or another, those actions will stop:
Don't no the right word to use? Make one up! (Score:4, Insightful)
Re:Don't no the right word to use? Make one up! (Score:4, Informative)
Don't no the write word too use? (Score:2, Funny)
Anonimity versus security (Score:3, Insightful)
Re:Anonimity versus security (Score:2)
Re:Anonimity versus security (Score:3, Interesting)
Require people to sign their mail with a key signed by the trusted third party. Drop mail from people who don't.
Granted, this won't stop the mail from hitting your mail server in the first place. But how is this a security risk?
Re:Anonimity versus security (Score:5, Insightful)
It is one or the other. It is impossible to increase security without reducing anonimity.
Rubbish. Anonymity comes within a context. If you give all your friends keys to your apartment, that doesn't necessarily tell you which individual was nice enough to drop off your mail and water your plants while you were on vacation. Similarly, if you sent me a key in the mail, you will have extended your web of trust, but completely anonymously; neither you or your friends know who I am seen in your apartment.
For example, there is not yet a possibility to only receive email from people that have revealed their identity with a trusted third party. I am affraid that is mainly a problem of legacy that a secure email protocol has not been deployed yet.
I'd say you're wrong here, too. SPEWS and other blocklists are examples of exactly that kind of trust issues being applied to current mail systems.
Re:Anonimity versus security (Score:4, Insightful)
That's a pretty weak argument. You're waving around strong statements involving the word 'security', but you only expand upon 'security' in the context of verifying one's identity.
Email systems which verify identity have existed since PGP. The only reason you're not using it is because your friends aren't. Of course your friends aren't because your not... but why?
You and your friends likely talk about nothing worth hiding.
Personally, I think that the real battle is between anonymity and privacy. Anonymity on the Internet provides an uncontrolled avenue for crimes such as cracking, trading in illegal materials, fraud, stalking etc.
Law enforcement would be happy to abolish anonymity.
Commerce doesn't like true anonymity because it discards valuable mareting data. They for the most part seem to be happy not knowing that Bob visited the Honda website, but simply that those who visit the Honda website also have shown interest in the following car stereos, bicycle racks, autorepair places, insurance companies... etc. So pseudonymity through random identifiers is generally o.k., but not anonymity.
However... on the Internet, anonymity is critical for privacy. With crappy security practices by Microsoft etc, it is usually not too hard to link random identifiers to real-world identity, and then before you know it, your insurance company raises your rates because you express interest in fast cars, racing games and car mod sites.
Total anonymity would protect this.
And what about pseudonymity? Adopting a pseudonym to hide your true identity and using it to express your views?
What if your employer obtained your Slashdot ID? and started exploring your posts? What if they didn't like what they saw?
Without complete anonmity to manipulate the pseudonym, your real-world identity can be determined. How could they do that? Right now, it is tricky. But any action against anonymity makes it easier for them.
Far worse would be government examples. What if... the government decided that people who have something to hide are criminals and need to be investigated? And the government found out that you were using PGP?
But I don't have time to fully express this idea... that's the gist of it though.
Anonimity INCREASES security (Score:2)
Anonimity also encourages "unextorted" behavior. Voteing is a good example - on an individual scale blackmaling someone to vote for a candidate is very difficult. The same ap
V-I-R-U-S-E-S (Score:3, Informative)
Thank you.
It's easy! (Score:5, Funny)
- viri
- virii
- viriii
- viriv
- virv
- virvi
- virvii
- virviii
- virix
- virx
(nicked)Justin.
Re:V-I-R-U-S-E-S (Score:4, Insightful)
Re:V-I-R-U-S-E-S (Score:3, Funny)
Hackers (Score:2, Insightful)
Re:Hackers (Score:2, Insightful)
if 90% of the people use the terms "incorrectly", maybe you should reconsider your own views on what is correct and what is incorrect?
Re:Hackers (Score:5, Insightful)
Ofcourse not! Media can herd 90% of the people(or even more) in to thinking whatever they want. That doesnt mean that you should change your views to synchronize with it.
Re:Hackers (Score:3, Insightful)
Try going to the grimiest bar in your part of the world, find a random drunken psycho, and tell him he looks gay. Then try to explain that "gay" means "happy" and see what happens.
Cliches (Score:2, Insightful)
Re:Cliches (Score:5, Insightful)
Re:Cliches (Score:2)
Great so . . . . . (Score:2, Interesting)
I believe there is an answer (Score:5, Interesting)
The Internet is not a planned system. It grows and connects like a natural system obeying laws such as Zipf's Law.
When it comes to security, the best model for what is going on in the Internet is also an organic model, namely the naturally occuring phenomenon of parasites, and the way these evolve in any real or simulated ecology.
I've gone into boring detail in my journal [slashdot.org].
My opinion is that until we use natural models, and learn from them, we will not be able to stop the rising tide of parasitical code that infests the Internet.
"Monocultures" are a large part of the problem, and the Economist rightly argues that opening the Windows source code to third parties would create more variety and thus more security. But I think we have to go much further, towards systems that actively evolve to protect themselves against parasites.
I've been criticised for saying this by people who say "it's just a metaphor, it does not mean anything". This is untrue: it is a model, one that we can use to understand what the heck is going on: what are the dynamics behind the process, what are the weaknesses of today's infrastructure, and what are the best solutions.
Let me summarize this one more time: The internet behaves like an ecology, obeys the same laws as natural ecologies, falls prey to the same problems as natural ecologies, and if we want to create structures that survive these problems, we must understand things in terms of an ecology, not a planned design.
Re:I believe there is an answer (Score:2)
Set up a million computers... (Score:4, Interesting)
It's the people and their ways of using the Internet that turn it into a natural ecology.
Laws are not the answer: it will just create a criminal underground. You cannot legislate against human nature - look at the "war on drugs".
Tighter security is not the answer: every lock designed by a human can be picked by a human.
Open source is not the answer: any suitably complex system, transparent or not, will have security flaws, usually at the user interface point (think: weak passwords).
Security patches are not the answer: parasitical code can spread many times faster than any human reaction time.
I believe the answer is that computer systems will have to evolve something similar to an immune system, based on recognising friend-or-foe, and capable of regular pseudo-sexual exchange to scramble the locks against parasitical code that has adapted. Finally, it is likely that parasitical code will eventually be co-opted (just like the bacteria in our guts) into less harmful roles.
To put this into context: the wars in your intestine started with the very first life forms and have been one of the basic engines of change in evolution for 3.5 billion years (along with climate change). I believe we're only at the very first stages of this process with the Internet, but inevitably we will follow a similar route.
Anyhow, I will be long dead before this actually happens. It's just idle speculation.
Re:Set up a million computers... (Score:2)
The fact of the matter is, that "parasitical code" or rather destructive code, is no more than an extension of the aspect of human nature that is destructive.
If the internet truely were a natural system, virus and the like would never cease to exist - billions of years of evoultion must have taught us that much.
Regulation... (Score:2)
Regulation is not the basis of human civilization, it is an effect of it. Whenever people get together to try to cooperate on solving a common problem (and this is the basis for human society), they will define rules and an authority to enforce those rules.
Attempts to plan or regulate society without respecting the natural tendencies of people tend to create disasters. (Think of any "planned economy").
And yes, I believe that viruses will never cease to exist. It's been 20 y
Re:Regulation... (Score:2)
"a self-replicating organic pest that uses human weakness to infest a technical infrastructure. So long as there are people, there will be viruses."
Whereas I would describe it as
"a self-replicating program written by a malicious programmer to infest a technical infrastructure. So long as there are people/computers, there will be (computer)viruses."
I do this because I do not see virus(and o
Re:Regulation... (Score:2)
There are many cases where complex problems are best understood by looking at people not so much as intelligent, proactive agents of change, but rather as dumb followers of rather simple rules:
- traffic jams
- crowds and riots
- stock markets
- economic systems
- political systems
- transport
etc. All hefty problems that only make sense when you ignore human proactivity and see people
Re:Regulation... (Score:2)
More general, while insight undoubtly can be gained from applying biological models to non-biological phenomena, in does not change the the properties of the elements in the model. Understanding an object does not change it, but it can bring change in how the object is perceived.
As you can see, I am afraid my perspec
Re:Set up a million computers... (Score:2)
Nope - what about public/private key crytography? It's easy to create a huge number from 2 primes, and fiendishly difficult to work out what those two primes were afterwards.
Re:Set up a million computers... (Score:3, Insightful)
However, it is impossible (as far as I can see) to actually implement this in an unbreakable manner. At some point, a cryptographic lock that is used by people depends on human interaction, and at that point, it can be picked, often in the most simple of ways:
"Hey, random dude, what's your passphrase?"
"Oh, I can't tell you that!"
"Go on, I'll give you a free pen"
"OK, it's MyDogIsSickAgain".
"Cool, thanks!"
"You won't use it, will you...?"
"Nah, of cour
Elimination of failures (Score:2)
However, look closer, you will see that these do actually take place. Software competes for space on hardware, for network bandwidth, and for user attention. Every CPU cycle and packet absorbed by a parasite means less for honest software. Every minute spent deleting spam is a minute less for honest work.
Why don't we just implement more security? (Score:5, Insightful)
No clever ideas like this are, were, or ever will be a suitable substitute for implementing real security. People need to wake up and realize that "hackers" are successful because peole still prefer convenience above all else.
For one, we still have this serious problem of people using software that is fundamentally insecure (Outlook, IE, ISS, Windows, etc). Nobody seems to be getting the point that Microsoft products fail utterly at meeting any of Microsoft's promises about security.
Of course, I would venture that is not even the biggest problem. People refuse to use strong passwords (or at least change them regularly). Software is not kept updated on servers (I recognize that free and open software like Linux is insecure if you're behind the times). Services are kept wide open so that nobody has to go searching for access (think file shares). Nobody uses encryption (viruses and spam would cease if company mail servers required valid PGP signatures from employees on emails before they got delivered),
There's so much that needs to be done. The above is hardly an exhaustive list (nor was I making an attempt to create one), but nobody seems interested in taking a crack at what really matters. Instead most seem to be more interested in silly ideas like "hacker bounties" which would be utterly ineffective against a group of people which do not seem to fear consequences for their actions.
Cure the sickness; don't treat the symptoms.
Re:Why don't we just implement more security? (Score:2)
I can understand how the ISS could be fundamentally insecure. I mean, who'd a thunk you'd have to lock your doors in space too! Damn kids and their space station jacking gang wars in space.
Re:Why don't we just implement more security? (Score:2)
What about when you get people to realize the risks of hackers and they still think the cost in time and effort is not worth it?
- "You can either take 50 hours worth of classes in internet security or you can reinstall your computer every fourth month because of hackers and virus inf
Re:Why don't we just implement more security? (Score:2)
I'd like to point out that these are not practical and they're not what I'm suggesting.
50 hours is overkill in training most employees about security, although something in that neighborhood is appropriate for managers to get them to appreciate the value of security. Policies and procedures handed down to them by IT should be sufficient. (Of
Why not both? (Score:2)
We have locks and alarms, we have liability laws for vendors who supply unsafe goods, and we offer rewards for informing on criminals.
>silly ideas like "hacker bounties" which would be utterly ineffective against a group of people which do not seem to fear consequences for their actions.
Wouldn't destructive virus writers be more fearful if they knew that their "friends" might turn them in
Eliminating online anonimity (Score:5, Insightful)
Isn't eliminating online anonimity practically impossible? What about cybercafes, for instance? (Although not big in the USA, cybercafes are one of the main ways to access the internet in many poorer countries)
Secondly, supposing you did manage it by imposing some kind of draconian laws i.e. you have to log on at all cybercafes with some universal ID. Then wouldn't identity theft become an even bigger problem - i.e. hackers would pinch other peoples identities to hack.
Re:Eliminating online anonimity (Score:2)
That might have been because you were paying with a credit card. In many countries you have to show ID if paying with a card. I don't know of any law in Italy that demands ID at Internet Cafes.
Security will never be achieved (Score:5, Insightful)
The internet will never have total security. There will always be ways around any programing that was made. There will always be bugs, loop-holes, etc. We are not perfect in our ability to program, and subsequently are coding is not perfect.
But with this being said that doesnt mean that we cant do anything to help protect ourselves. We can make effective practices of protecting systems by physical methods. If you dont want people to hack your system dont connect it up to the internet. While I know that those nuclear technicians love to surf the web while at work, but that doesnt have to be the same system that runs the reactor.
Virus writers will always exist, just like music sharing, and ads [slashdot.org]. The key is just how you will negate their effects.
we stand hunched (Score:2, Interesting)
If Microsoft is so secure, how come it:
1. doesn't support APOP in outlook [express]?
2. doesn't support IPsec tunnel?
3. still supports Frontpage?
4. doesn't let you see whats going on (netstat on unix shows process related to the socket opened, windows does not)
on and on..
Why is the only way to somewhat-secure Windows limited to buying third-party apps?
Re:we stand hunched (Score:2, Insightful)
Because Outlook Express is a pretty mediocre piece of software all the way around?
2. doesn't support IPsec tunnel?
Huh? Windows supports IPSec tunnels just fine, as long as you aren't using Win95/98/ME. You aren't using ME, are you?
3. still supports Frontpage?
Umm, because it's a successful commercial product? Duh? Perhaps you meant to ask why they don't improve FrontPage in any meaningful way?
4. doesn't let you see whats going on (netstat on unix shows pr
Just what we need... (Score:5, Interesting)
Imagine this: your little sister sits in front of her computer, ready to send the latest pix of her little doggy to your grandma.
Five cops burst through the door and arrest her for spreading that noxious "I love goatse.cx!" virus. Yes, that virus. The one that installs a spambot on your Windows machine.
Her crime? She clicked on that little "Rudolph the red-nosed reindeer e-postcard" that was sent to her by the nice girl she chatted with yesterday.
End result? '000s of $$$ spent in legal fees and millions of dumb IIS/Exchange servers crashed all over the world. And one very rich bastard, laughing all the way to the bank for denouncing an innocent.
Thank you, The Economist. Great idea.
Here is my offer: banish Microsoft products everywhere. Replace with medium- (Linux) to high-security (OpenBSD)OS everywhere and watch the [virus|worm] problems disappear. Oh, and make spamming a crime punishable by public castration. That should do the trick.
Re:Just what we need... (Score:3, Insightful)
Who better than a "hacker" to set someone else up to take the fall for spreading a virus? Root their box, get it to distribute the virus, leave a development trail in their files, post some whacko "hacker shit" to usenet, write some evil manif3sto and put it in a hidden directory, cover your tracks and then call the feds on them.
You could even drop some kiddie porn
New Haxxor Challenge (Score:4, Funny)
brilliant idea (Score:3, Interesting)
Bounty system, wow, that's a brilliant idea.
Instead of hacking systems, hackers can instead hack systems, frame teenage kids, and make money! Sweet!
Digital paper trail? (Score:2, Insightful)
If the government can do it, why couldn't a cracker?
Bounty == Obscurity (Score:2)
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
That's not interesting at all. As covered here [slashdot.org], that's what MS thinks is the way to address the issue. All that's interesting about that situation is that they've set aside 10 times as much money as they have current bounties for; how is expecting 10 times as many security issues in the future consi
Where does MS want to go: (Score:4, Interesting)
For an OS and Office writer, which is what MS basically is, it helps to dedliver this 'value' in terms of Service Packs and bug fixes for problems it was responsible in creating, and which it is morally obliged to undertake for free, rathre than for an annual 'Subscription (Dis)Advantage Agreement'.
Thus, it is more crucial to know of MSs plans, rather than where we stand currently - while discussing this topic of security. If MS gets away with Palladium, they might actually write secure code; if Palladium fails to take off, users will have to live with these worms and security hazards.
Which is why I posted this earlier, and got modded Flamebait!!
" Where does Microsoft want us to go tomorrow? (Bankrupt, yes,.. that sems to be the answer).
Whereveer we stand now, we stand naked - ready for exploitation; the situation isn't changing fast, either."
Babies and Bathwater (Score:5, Insightful)
On the surface, this is a sensible statement, but this is the kind of thinking which must be debunked at all costs. What is needed are systems which allow anonymity where it is valuable and eliminate it where it is not.
Just as in the real world, we have the option of using our credit cards to buy groceries, and cash to buy or anti-government literature, the internet needs security where security is important and must still provide anonymity where users judge it to be important to them. To say it is impossible to provide both shows a failure of imagination on the part of the commentator.
Enforcing security by exposing everybody to scrutiny denies us freedom. Don't let it happen. Chose the right to be an anonymous coward, if that's what your subject demands.
Next up -- Hackers Hack Your Life! (Score:4, Interesting)
-
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
If anyone thinks this will work, then I feel sorry for them. Hackers by and large aren't going to rat on each other. There's one really good reason -- if the one they ratted on finds out who they are, or his/her friends find out, then the rattee is going to be in deep doodoo fast. Facing this, they'll just take the route of least resistance and easy moolah and rat out innocents or even set up innocents and report them.Think about it, how hard is it to infect the average joe's computer with a trojan, worm or virus? History (heck, recent history in fact) shows us that it's not terribly hard. For some of these worms/etc. that come out, you don't even have to click on anything to get infected! So it'd be easy as pie to set someone up. Just infect their machine with a trojan, make their machine do Evil Things (tm) while they're actually active on it, cover your tracks, and report. Law enforcement tends to be overexuberant on catching cyber evil-doers, and there's a more than fair chance they won't dig deep enough to notice the tracks the hacker left on the innocent guy's computer.
And to be honest, they probably won't get the chance to. How many average joes out there have done something not-so-legal? Probably a lot, it seems everyone and their brother's wife have illegal software of some sort to hear people casually talk about it. I've heard customers at Wal-mart ask employees if they can install ___ software on more than one computer. (Often it's anti-virus software they're asking about ironically.) When average joe is faced with getting in trouble for the stuff he knows he's done wrong, he'll probably cop a plea bargain to avoid that coming to light. And law enforcement will go along, after all it will look like a win for them on the public relations front.
For those that will scream that law enforcement wouldn't do these things, I can only tell you that I hope you never get to find out first-hand just what they will and won't do. I had the misfortune and it was a real eye-opener. I prefer not to go into specifics, but I will say that before my experience I never believed any of the supposed "conspiracy theories"/etc. about how bad law enforecment and/or the FBI/etc. were. Now I think they're all dead on.
Bottom line, putting out bounties on cyber-criminals would result in many innocent victems, and probably very very few real criminals being caught.
Hypocrisy (Score:2, Interesting)
Not surprisingly, Microsoft bristles at this line of thought. The only reason the firm has been bundling the operating system with applications is that customers want it to, says Mike Nash, a
But why... (Score:4, Insightful)
But why, in the first place, did those computers have outside access? Or rather, entry points.
If a computer is controlling a really important piece of hardware (nuclear plant, anyone?), I sure hope it is NOT connected to ANY outside network, for whatever reason. And if it is, the one who decided it was a good idea should be held responsible for whatever happens, and lose his job, get a big fine that will make sure he will NOT EVER make the same mistake... Maybe this way security will be a level higher.
Everyone stop trolling about it! (Score:3, Funny)
Incentives - what a great idea! (Score:3, Interesting)
from the article... (Score:2)
But the patches often create more security problems than they fix, and there is a fear that Microsoft might use such regular access to desktops to keep rival software-makers away, thus reinforcing the source of the original problem, its monoculture. "If you don't trust us to download our patch, then you shouldn't be running our software," counters Mr Charney [a M$ exec], as if consumers had a real choice.
I almost choked when I read th
Dynamic IP addresses are source of trouble (Score:4, Interesting)
One of the growing problems is the large base of broadband-connected (cable, DSL) users that ISPs insist on putting on dynamic IP address pools. We all know that there is no technical advantage to the dynamic IP addresses, since practically everyone is connected 24/7 (this is not the same situation with dial-in modem pools, where dynamic IPs are the best way to go).
If ISPs allocated static IP addresses to all their cable/DSL customers, we would see tremendous security gains because customers' addresses would stand still while they are tracked down.
Perhaps it's time to see some government regulation that requires that an ISP that provides broadband services where customers are connected more than X% of the day has to provide a static IP address. ISPs like to provide dynamic addressing because they have a persistent fear of people 'running their own servers' (bullshit), plus they can sell static IP addresses. Their approach is detrimental to general Internet security.
Imagine if there was a type of cheap cell phone service designed to facilitate outgoing calls only, accomplished via a dynamic origin phone number (that changed daily), making nearly impossible to have someone phone you back. Don't you think such a phone would be a huge source of all kinds of abuse? That's what ISPs are making possible by dynamic IP addresses on broadband customers. These hosts become rogue, because they are moving targets.
Re:Dynamic IP addresses are source of trouble (Score:4, Interesting)
It has more to do with the costs of providing that service. Giving your customers static IPs involves support costs unlike DHCP's plug-n-go. A rough guess would be that for every customer you'll end up spending 5 minutes of support time if you use static IPs. And that's just support call time.
Now add in churn of 10% (very rough guess) per month for a few thousand customers and the administration costs of keeping track of a static IP system start to factor in. Stuff like handing out new addresses, releasing addresses for accounts that have been canceled - some of which can be automated if you pay $$$ for the capability.
OTOH, configuring a DHCP server is pretty much a once and done deal. Scales nicely, requires little-to-no end-user knowledge, and is a lot cheaper.
Unless it gets to the point where going the DHCP route becomes more expensive then administering static IP addresses, you're not going to see a change in the way ISPs do business.
Silly Checkpoint Claim (Score:3, Insightful)
Is this really the president of one of the largest network security companies in the market claiming that not one company in Checkpoint's 90% market share was affected by MSBlaster?
Incentivate? (Score:2)
zerg (Score:2)
The Economics of the Bounty . . . (Score:4, Interesting)
Let's say I am really, really good.
Let's say that the cracker who did the deed is really, really good and very dangerous.
Let's say that the bounty is really, really high.
Let's say that there is another cracker, call him "stooge," who is really good, somewhat dangerous, but not as good or dangerous as am I.
I want the bounty, I can very effectively frame stooge, who is pretty darn good, but framable, and not so dangerous.
or i can go after someone who is much better and more dangerous.
Looks like all a bounty system would do is incentivize crackers to do very effective jobs of framing innocent, less effective, hackers.
The Economist should know more about Economics.
Locks keep honest people honest . . . (Score:2)
Use of disguise and false identities has been a criminal (and espionage) tool for hundreds of years, despite extensive efforts of governments to document and prevent such conduct. Why would this be any different? Except now, only the crooks will have anonymous identit
The Economist is a pile of crap (Score:2)
This is OT, it's just a warning to "consider the source."
The Economist has, in the past decade, gone from being reasoned and sensible to a shrill mouthpiece for The Right. Any story bigger than one column inch becomes a vehicle for what can best be described as capitalist propaganda.
Even after their hawkish view on Iraq --that Saddam posseses WMDs and is an imminent threat -- stands discredited, they still toe the neocon line.
The only thing left of value in The Economist is the wonderful charts and
Bounty=employment (Score:2)
A lot of people argue that bounties will drive hackers (for the assumption of the article, blackhat varieties) underground, or perhaps incite turning in innocents for money... which is likely possible. You might want to consider that after a certain period of time, a process will be garnere
Easy to fix (Score:2)
A few hundred lawsuits later, everything will be as tight as it was in the Multics days.
Re:Where do we stand : Abridged version (Score:4, Funny)
Re:trust (Score:4, Interesting)
Re:trust (Score:3, Interesting)
Re:trust (Score:2, Insightful)
Re:trust (Score:4, Insightful)
A crime is the result of motivation and occasion. Instead of trying to extinguish motivation through fear of jail (which does not stop crime entirely) why not add other methods, or work on preventing occasions (transparent societies) ?
Besides, if you think the whole justice system isn't there mainly to bring vengeance to victims and their relatives, you need to go watch A Clockwork Orange.
Re:trust (Score:2)
What, pray-tell is a "transparent society"? If you're talking about one in which all the details of each person living within it are known to all of the others, then I'll thank you to please perform a sanity check. Preventing crime is one of the primary reasons that we have jails...the reason that crime levels are not receeding is that said jails only work to prevent the commission of crimes
Re:trust (Score:3, Insightful)
I never said we should get rid of jails, I said we needed to explore methods of preventing crimes instead of limiting ourselves to punishing crime by increasing/adding jail time (I am not formally against it, but I think it will inevitably reach an efficiency limit anyway). Some people think transparent societies are one such prevention method. Some people disagree, others propose to tag everyo
Re:trust (Score:2)
The above threw me way off when r
Re:trust (Score:3, Insightful)
Back to the idea of offering bounty ince
Re:trust (Score:3, Insightful)
Trust no one
Re:trust (Score:5, Interesting)
"Security" doesn't have anything to do with anonymity or not. Think of it this way - anonymity doesn't make a bank more or less secure. You could be famous and rob a bank. What recognition gives is not preventative; it is only reactive. It allows you to go after someone after they have done something you don't want them to do.
Some would argue that this is a deterrent to "security violation" since it would be known that if you do something you're more likely to be caught. However, for those apt to try and perform a "security violtation", this just adds to the mystique, honor, whatever. Except for the truly insane, who just don't care. For most people, non-anonymity is just an annoyance because they wouldn't do anything wrong in the first place.
The question for the computing world then needs to become which stance to take. It seems the "don't do things unless I tell you it's OK" is infeasible since we know that people will do things they know aren't OK. Then the question must be what kind of walls to put up. Most "security" issues today are because the walls are insufficient, not because we can't go out and catch the people coming into the barn and stealing the chickens.
And why are the walls insufficient? Well, the fundamental problem is that usually a breach is something that is allowed to happen but by someone who shouldn't be allowed to do it. This is why people are clamoring for identity validation and all that jazz, but we are fast learning that identiy is not even sovereign in this world; at least not in a non-morally-ambiguous way (i.e., biometrics).
I must admit that I don't have answers to the questions of security, because whenever you allow people to do something, there is always a possibility that it will be abused. And in a world where (at least in the USA) people are taught more and more that they are not responsible for their actions (if this were not the case, we would have far fewer lawsuits) security will not be solved by any technical means.
Re:Spelling! (Score:3, Informative)
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
Not to mention the crackers/hackers thing which has already been mentioned
Re:That's why TCPA is important (Score:4, Insightful)
And if TCPA does have centralised control, you have the problems of total monitoring, proprietary lock-in and the erosion of usage rights for digital media.
There is a parallel with existing firewalls - they can increase security by blocking certain content (e.g. RPC exploits using port 135), but trusted web traffic with IE-exploits or virus-laden emails usually sail through.