The Security Industry Is Failing Miserably At Fixing Underlying Dangers 205
cgriffin21 writes: The security industry is adding layers of defensive technologies to protect systems rather than addressing the most substantial, underlying problems that sustain a sprawling cybercrime syndicate, according to an industry luminary who painted a bleak picture of the future of information security at a conference of hundreds of incident responders in Boston Tuesday. Eugene Spafford, a noted computer security expert and professor of computer science at Purdue University, said software makers continue to churn out products riddled with vulnerabilities, creating an incessant patching cycle for IT administrators that siphons resources from more critical areas.
What's the solution? (Score:3)
Re: (Score:3)
Re: (Score:2)
I think the airline industry should concentrate on avoiding airline crashes.
Re: (Score:3)
More like saying the the airline industry would be much more efficient without human error...in fact it's pretty much the same thing. Wouldn't it work better if planes didn't need safety equipment or redundant safety checks, and all the passengers and crew moved with perfect timing like they were in some kind of dance routine?
Human error will always exist. Deal with it.
Re:What's the solution? (Score:5, Insightful)
I'd say the aerospace industry is dealing with it a lot better than the software industry. Perhaps we should get held up to the same standards, maybe then we could earn the title of "(Software) Engineer".
Re: (Score:3)
I'd say the aerospace industry is dealing with it a lot better than the software industry.
This is somewhat because the airline industry has been around for far longer, but mostly because their screw-ups usually generate large numbers of dead people.
Re: (Score:3)
This is somewhat because the airline industry has been around for far longer, but mostly because their screw-ups usually generate large numbers of dead people.
Or because the FAA holds the airplane manufacturers to an extremely high standard for their software.
There's no one holding Microsoft or the creator of Flappy Birds to any standard of security.
/I know /. has some programmers who are familiar with airline standards, so maybe they'll chime in.
Re: (Score:3)
Although that may be true, the FAA also requires all the backup systems to software driven indicators to be mechanical. So for example, the flight level indicator is duplicated as a mechanical instrument in case the electronic one fails. Same thing with the airspeed indicator, fuel gauges and other critical gauges. Especially if you are talking passenger aircraft. Many even have mechanical backups for hydrau
Re: (Score:2)
I'd say the aerospace industry is dealing with it a lot better than the software industry. Perhaps we should get held up to the same standards, maybe then we could earn the title of "(Software) Engineer".
The problem is that there are subsystems on a aircraft can be transparently seen to be critical or non-critical. A loose latch on door to the garbage bin in the galley is not likely to take the entire plane down.
The same can't be said of a computer system. Any program that breaks security breaks it for the entire system.
Re: (Score:2)
Re: (Score:2)
And what about a bug in the sandboxing?
Combined with the presence of the sandbox giving the user a false sense of security...
Re: (Score:2)
Or maybe I'm putting words in their mouth.
Re: (Score:2)
A loose latch on door to the garbage bin in the galley is not likely to take the entire plane down.
No cell phones on board!
And don't even think about having passenger/pilot-accessible Ethernet ports on board connected to your flight control system's LAN.
Re: (Score:2)
More importantly is the fact that aircraft are operated by trained pilots, and maintained by trained maintenance staff - both of whom have to undergo rigorous tests to ensure they are capable of doing the job and have a very good understanding of the aircraft they're working on.
Re: (Score:2)
All that would result in is software that no one will buy or want. You want to pay $5000 for your new smartphone because it was held up to the same engineering standards? The reality is in a consumer world people get what they pay for and the vast majority are not willing to pay what it would cost to have the software they use engineered to those standards. If you had a choice between a Samsung Galaxy s5 for $500 and a Brand X with same features but at $5000 because it has software that was designed to tho
Re: (Score:2)
Re: (Score:2)
who do you think is going to spend 100 billion on securing it? and that will only be for the current release, what about the 100 billion needed next year or the year after. Software is evolving and changing so rapidly that the investment isn't a once off and at those costs a single failed product becomes enough to bankrupt a company.
Less new code, more refinement (Score:2)
Re:What's the solution? (Score:5, Informative)
Well companies can do much more to improve on that front though.
1. Architect the product, not just build it. All too often the focus is on meeting business objectives and security is added later. An product that was well thought-out and designed handles security as part of the core design as well as the business objectives.
2. No Back door, design the program so the programmers can't get in without having rights to do so. The password DB should be only managed by the computer and humans shouldn't be able to figure it out.
3. Infrastructure planning. The Website shouldn't also be the Database server. The Database should only allow access from select sources, and give permissions that are appropriate to the user.
4. Plan for failure. Figure if someone breaks into the system find way to minimize the impact. Make sure the Salt for your hashes are hard to find, etc...
Re: (Score:2)
But the companies exists solely to make profit to their owners. Which means "time to market", which means "security is not an option - until it is really needed".
For example, I am certain that 99% of Facebook/Twitter/... users don't give a shit how secure it is - especially as they know NSA has unlimited and unaccountable access into it.
Re: (Score:2)
Not being able to figure anything out is a bad thing, the more complex your system is the greater chance of there being bugs, and if your system is important or widespread enough then *someone* will take the effort to figure it out and probably understand it a lot better than the people tasked with running it.
Having a complete understanding of how a system works should not allow that system to be compromised if it's well designed. Never rely on obscurity.
Re: (Score:3)
From my perspective "Cheap. Fast. Good." all go together. The quickest projects to complete are well designed. Maybe I consider it cheap because
Re: (Score:2)
It seems like his solution is: Simply don't release code that has bugs in it. Which is kind of like saying that the airline industry would be so much more efficient if we could just get rid of wind resistance.
You could posit that but the actual quote is:
which seems fairly reasonable, b
Re: (Score:3)
Honestly I think the problem is the universities don't actually teach and CS. They don't even teach programing they teach C++, C#, or Java.
We would be better off if students were taught in their professors boutique language that exists nowhere in industry frankly. That would at least move the emphasis toward general theory and patterns. As it stands today most grands spent all their time memorizing whats in the standard library for whatever language they were taught and don't have any clue how to archite
Re: (Score:2)
CS is a subfield of mathematics. It's useful in software and computer engineering, but it's the engineering field you should be talking about, not a subfield of what is, in essence, an art [worrydream.com]. And yes, I do agree with Lockhart. Wholeheartedly.
Re: (Score:2)
Oh please! A CS degree is a license to get a coding job and nothing more (any more).
No employer is going to hire a coder who doesn't have at least 2 years in the currently fashionable language in the dominant ecosystem.
The geeks you're talking about are Computer Engineers, but if you're not a top-ranked grad from one of the top-12 schools, you're going to wind up as a codemonkey working for an accountant.
Re: (Score:2)
So the next thing you know unsanitized input is being concatenated onto some string and fed to some cousin of eval() in the language du jour.
After that, we wait for the user keypress with a system("pause").
Re: (Score:2)
The smarter approach would be to have third-party auditors and certification bodies give particular programs a rating based on their code and processes.
Excellent idea. Not sure that the insurance is really needed, the trick is simply to market the certification or auditor groups properly. IT PHBs just love Gartner. They'll quote their releases, follow their reports, and buy everything they say without question. So you need an organization like that on the software or software developer auditor side - Gartner does nothing like that. A similarly positioned organization could easily affect the stock prices or VP funding availability of any software selle
Re: (Score:2)
And how would these rating agencies select the code they were going to audit?
They can't audit everything, so they would prioritise... Vendors would pay to have their code audited, and perhaps try to corrupt the process to get a better rating. OSS code would not be able to pay to get audited, and thus would never have a rating at all.
There are already various governments operating such schemes, they are extremely expensive and slow, with the final result being a small cartel of incumbent suppliers where the
Re: (Score:2)
Which is kind of like saying that the airline industry would be so much more efficient if we could just get rid of wind resistance.
Because of my contrary nature, I immediately started wondering if that was actually true. As speed increases, I imagine that fighting drag does get to be harder than fighting gravity, but I don't actually know. But a bigger question is, what about falling out of the sky when your propulsion system fails? No parachutes... you need an active recovery system.
I think we'd have stuck with trains and boats...
What would have to happen to physics to eliminate wind resistance?
Re: (Score:2)
Re: (Score:2)
What would have to happen to physics to eliminate wind resistance?
Not certain here, but I suspect that lift might also a zero wind resistance issue. Any Fluid dynamics ppl here?
Re: (Score:2)
"As speed increases, I imagine that fighting drag does get to be harder than fighting gravity" Indeed it does. As speed increases, lift per unit wing area rises.
I'm talking about the drag on the rest of the plane, though, not the part that's generating lift. Obviously you need that for planes to work. That doesn't rule out commercial air travel, though; they could still use rockets. But I would have imagined that you'd have to be going pretty fast to make that cheaper in terms of energy than flight in the really real world, not the postulated one.
"what about falling out of the sky when your propulsion system fails?" Many a good plane can glide to a landing with no engines running. The space shuttle does it from Mach 26...
Yes, but aren't lift and drag two parts of the same phenomenon? It's my understanding (bracing for correction?) that you
Re: (Score:2)
Yes, but aren't lift and drag two parts of the same phenomenon?
In a way, yes. The airplane wing is curved on the top, and flat on the bottom. The wind has to travel farther over the top of the wing than the bottom, meaning there is less air pressure on the top of the wing, more on the bottom, and that's what generates lift.
Re: (Score:2)
In a way, yes. The airplane wing is curved on the top, and flat on the bottom. The wind has to travel farther over the top of the wing than the bottom, meaning there is less air pressure on the top of the wing, more on the bottom, and that's what generates lift.
Well, ISTR there's still some debate about that being the whole reason, but both postulated effects (I thought the current theory was that both were real?) depend on wind resistance. Besides, you can achieve flight without airfoils.
Re: (Score:3)
That is the most frequently cited bunch of baloney in explaining lift. The easiest way to demonstrate what a load of bull it is, is to point out that a paper airplane develops lift and glides fine, even though both the top and bottom of the airfoil are flat. A clos
Re: (Score:2)
That is the most frequently cited bunch of baloney in explaining lift. The easiest way to demonstrate what a load of bull it is, is to point out that a paper airplane develops lift and glides fine, even though both the top and bottom of the airfoil are flat.
Bah! You called my explanation "baloney" and then you post THIS!?!? What a bunch of hokum. Paper airplanes don't generate lift - you're just describing resistance. A feather will "glide" even slower - are you going to claim it's generating lift too?
Re: (Score:2)
You just doubled down on STUPID. Leave aerodynamics to those who understand it. Hint: yes, of course both a paper airplane and a feather experience lift when gliding and fluttering respectively.
Re: (Score:2)
Re: (Score:2)
TL;DR version (Score:2, Insightful)
"We have no consequences for sloppy design and we don't hold organizations accountable for bad things."
Well obviously, we need Eugene Spafford!! (Score:2)
Clearly Eugene Spafford must be put in charge immediately, since none of the rest of us have figured any of this out!
There's no money in being secure (Score:5, Insightful)
But there sure is a lot of money in selling threat paranoia.
Plus software vendors are apparently immune from product liability, so they never bear any costs for defects that lead to poor security or for implementing security poorly. If they had liability for this I think you'd see a lot fewer security defects, but probably a lot fewer features as well.
Re: (Score:2)
Re: (Score:2, Interesting)
Hah. This is too rich. I'm an engineer. An actual engineer in the traditional, licensed variety. I design physical structures that are used by the general population and have to ensure that they are safe for the next 50 to 100 years. Oh, and that they will survive the next 1-in-5000 year earthquake event, etc. I have a whole lot of product liability for what I put out and I can assure you, I do not make the same amount of money as a doctor. Hell, I don't even make the same amount of money as most so
Re: (Score:2)
I don't think liability would help. For example car manufacturers are only liable if some design or manufacturing defect causes an accident, not if a third party attacker cut your brakes. You could try to argue that they should armour plate the brake lines but I don't think you would get very far.
That's the problem with security. If you put the weakest, most puny and ineffective lock on a door, then hang the key next to it with a sign saying "authorized personnel only" it's still breaking and entering if so
Re: (Score:2)
>Just look at Heartbleed - OpenSSL is maintained by only a few programmers, and they aren't paid jack or shit.
Bullshit. They are gatekeepers to the code and they charge a fine fee to make modifications or add features.
The lack of documentation cements their position.
The sooner the beast is killed, the better.
If you don't have time to do it right (Score:2)
Holy buzzwords Batman! (Score:3)
... substantial, underlying problems that sustain a sprawling cybercrime syndicate, according to an industry luminary who painted a bleak picture of the future of information security at a conference of hundreds of incident responders in Boston Tuesday.
an ounce of prevention is worth a pound of cure. (Score:3, Insightful)
Re: (Score:2)
very few ever see a dietician before a Dr.
Does Dr. Oz's talk show count?
There are a few things we can do. (Score:2)
What we should do is research safe alternatives for languages (http://www.rust-lang.org/), more sandboxing of who can access what (SELinux, AppArmor), and better and simpler libraries (LibreSSL). No plugin Auto-run for untrusted sites.
Antivirus is cool and all, but its not as good as fixing the bugs. Unfortunately it is more profitable.
Re: (Score:2)
Well, you have 2 flaws right there. First, the verification method for "trusted sites" and second, the trust and verification of the trust authority. So you should have stopped at "no plugin auto-runs."
Impossibru! (Score:2)
Re: (Score:3)
Just because this thread needs a car analogy, too: Antivirus is no solution for crappy software any more than safety belts are a solution for faulty brakes.
Stockholders come first, security isn't important. (Score:2)
Working in this industry at several giant companies, the view is simple - the company works for the stockholders, the stockholders demand ever higher returns, and NOTHING the company does is nearly as important as increasing the short term stock price. So what money is spent on R&D will be spent chasing new "shiny" features and the absolute bare minimum level of security and bug fixes required to "continue leveraging the brand". In the mean time, the business will focus on increasing the productivity
Re: (Score:2)
The company doesn't work for the stockholders. The company has a mission, and the stockholders who don't agree with it are simply not your stockholders in the first place. They don't bother. The founders of a company are free to set the mission as they see fit. The mission doesn't have to be 100% profit- or ROI-oriented. It's perfectly possible to have a public corporation that's after greater things than money. Just because for example Microsoft isn't set up this way doesn't mean it's a law of nature. Far
Here's the problem. (Score:5, Insightful)
The "Security Industry" makes money for the shareholders selling "stuff". Any time they see a problem, they will treat it as an opportunity to sell more stuff, since that is how they make money. If the problem is because the customer has already bought too much stuff, they will still try to sell the customer more stuff since THAT IS WHAT THEY DO.
So if you want to be secure, what do you do? We all know: You get rid of crappy software, simplify your systems, remove unnecessary cruft and hire developers, network systems people and architects who can build you what you need securely. You do NOT hire the cheapest meat puppets who can find the company website and spell "javascript" and you don't outsource your security to the lowest bidder.
This requires real effort on the part of the company paying for all this: They need to recognize that the "Security Industry" and their shiny, happy sales droids are just parasites ripping off the public with the "latest and greatest security stuff that will really protect you this time I promise not like all the other times, I really really mean it THIS time!".
They really need to understand that the RIGHT way to GET Security is to design it in, have the right people building and managing it and proper oversight over all of it. To do that you have to treat it as a profession and a core part of what the company does, not as a "service" or "product" that can be "bought in" or "outsourced" to a low bidder.
Security needs to be treated as a profession in any company with a significant cyber presence, just like the accounting them, the legal team and the core business functions. Pretending it's "just something that we can buy from a vendor" is short sighted and ignorant.
Re: (Score:2)
The solution: Make laws that get board members at their nuts if they can be made responsible for security breaches and the loss of data.
Fines are a matter of risk management and cost accounting. Jail time is what turns heads.
Re: (Score:2)
Systems these days are so hopelessly complex due to running full-blown OSes (mainly Linux derivatives like Android these days) for convenience that guaranteeing security is practically impossible most of the time since nobody ever knows the system inside-out so everyone is relying on everyone else making their own part of the source tree work properly without unforeseen unexpected interactions between software components and also with the hardware.
Most developers and companies do not have the time and resou
Cash is King (Score:3)
Thanks to all of this, and the NSA/GCHQ Orwellian Internet world, I no longer do any commerce online.
Online for me now is chatting, posting, blogging, /., emailing, sharing source code.
I no longer do any purchases, or access any online systems that deal with money (banks, credit unions, etc), via the Internet.
Even in the real world, I try to only get my cash via walk-up to a bank teller. No more ATM use. No more credit card/debit card use, if I can at all help it.
Is trying to do a cash-only lifestyle a total time suck, and inconvenient? Yep.
I am certain I can still be a victim, but I am doing what little I can to not be an easier target.
"Always look on the bright, side of life..." -- Monty Python
The software industry not the security industry (Score:2)
The title (of both the slashdot post and the original article) is misleading.
The article cites one Eugene Spatford who observes that, "software makers churn out products riddled with vulnerabilities." That's not the security industry's fault.
He goes on to tell us that law enforcement is inadequately equipped and that criminals protect themselves by bribing government officials. That's not the security industry's fault either.
Of the tools the security industry does use regularly he says that, "We’re u
Solution: Don't buy crap (Score:4, Insightful)
Sorry, and I know I'll be very unpopular for this, but the blame is on YOU. Yes, YOU. You there who always have to buy the latest and greatest turd that someone puts into a shiny, sleek piece of plastic and calls it the NEW $whatevergadget. As long as you buy buggy, crappy, spyware-attracting, insecure shit just because OHHHH! SHINY! you get what you deserve.
Welcome to capitalism. If I can sell you a piece of turd that stinks, why should I waste money on perfume?
Make the companies pay! (Score:3)
Companies don't fix underlying problems because management doesn't see any value in doing so. They also see no risk in having insecure products. Until there are real financial penalties for blatant incompetence regarding security nothing will improve.
No one cares... (Score:2)
I've got over a decade of working on networked, embedded devices. With the exception of content security, I have never in my recollection been on a project where a significant effort was devoted to the security of the system.
I've worked for a company who made devices which process electronic payments. I asked them about security and whether they ever did an audit. The SW veep's response was "We use SSL."
No one wants to think about it. Security is a hard problem and it blows budgets. Forgetting about se
Thieves Are Welcomed (Score:2)
Can't fix the user (Score:2)
People will run malware for pennies [theregister.co.uk].
The programmers, sysadmins, and netadmins can only do so much. If you completely lock them down, the users can't do their jobs effectively and/or whine and complain and not buy your software or use your service.
People do pay more for bulletproof software and systems, but most people aren't buying airliners.
The problem is not the security industry (Score:2)
The problem is that basically all software is connected to the Internet in some way these days and a lot of the makers of software do not qualify as part of the "security industry" and really have no clue and no interest in making things secure.
Complexity... (Score:2)
Systems today are too complex for the users, and even the supposed administrators to understand... And all these added layers of extra "security product" just compound the problem. Many organisations are simply unaware of all the risks because they have no idea how most of these things actually work.
Secret services exacerbating the problem (Score:2)
Of course, if some morons decide instead of to fix problems to try to exploit them -- and to create a market for them, the problem sure is to grow even more.
"Yes, this car may be tipping over very easily, but we might need this to assassinate some foreign dignitaries, so we don't hell the manufacturer".
Security holes are caused by lazy developers / IT (Score:2)
How is that the "security industry's" problem? (Score:2)
This has nothing to do with the security industry, and everything to do with people who prefer to buy the cheapest product rather than a better quality product.
Further, this will continue to happen as long as the software industry maintains it's age-ist view that 'younger is better'. Younger people are not going to have the experience level of older people, which means they will be much more likely to make all sorts of mistakes that older people (who had also made those mistakes when they were younger, but
Re: (Score:2)
Anybody may write programs, and it looks like there's hardly a nitwit who doesn't. I've said it before, I'll say it again: The stream of crap won't cede unless the software industry is made liable for software defects.
The ONLY winners in that scenario would be the lawyers.
Re:How is that the security industry's fault? (Score:5, Insightful)
its a n underrated point - why don't software engineers have to make products as reliable and good as more expensive engineering projects... and I think the clue in is that question.
Why can't a software engineer make something that is as reliable as a bridge? Because a bridge costs a flipping fortune and can't really be reworked after implementation, so there's a huge incentive to get the entire team together to get it right. And that means the people who really make the bridge are the architects and project managers. In software terms, we have few architects and they're usually crap ex-developers who think they know it all, and project managers who are incompetents who think it was a job they can hide their lack of skill in. Meanwhile you have a load of developers who think they are the only ones who can do the job.
A really good software project would require a technical architect who really understood what was happening and how things worked, and a project manager who understood timescales based on experience and managing the project deliveries and organisation.
It would also require a project based on old technologies - no-one really has time to get to grips with something like 'real' engineers have to do because the platform they stand on gets whipped out from under them all the damn time - which is also a problem as the idiots who don't know a thing use this as an excuse to hide their lack of talent too (how many times have you heard that someone wants to rewrite in cool new technology almost for the sake of it - you can guarantee its because they can't hack doing the boring work maintaining or improving the old stuff, a lack of skill they'd still have if they did get to rewrite - no rewrite ever is any good, its almost always an even worse PoS).
So all in all, there's a huge lack of professionalism in software caused by a lot of factors but I think the biggest one is the real lack of earned experience. We don't allow the good stuff to be built upon, we throw it away and start again with something else. We throw the good staff away and say they're not keeping up with technology. We hire kids because they have some buzzword on their CV.
Anyway, we don't hold software engineers to the same high standards because we refuse to accept old, working stuff. We only want cheap new shiny crap. Its no wonder the software world has turned out like it has.
Re: (Score:2)
Re: (Score:2)
reminds me of a previous company.
It had a very well designed 3 tier architecture with a good set of security policies. One of which was that the web servers didn't have any connection tot he database servers, not even cabled.
Then the director of a acquired company was told his PHP website was to be put on the production servers, his attitude was one of "well, we'll put the web site on the webservers and just punch a hole in the firewall to the DB".
When he was told that couldn't physically be done... his att
Re: (Score:2)
So how did information get from the database to the web servers or visa versa?
Re: (Score:2)
it was a 3 tier system.. web servers talked to app servers which talked to the DB server.
Each comms channel was secured so if an attacker exploited the web server (as happens too often) then the attacker had to get past the other layers of security to even reach the DB, let alone export any customer passwords. When you realise many of the modules running on the app servers had limited access to the DB too, you realise that it was as secure as you're likely to get.
engineers have the power to say no to boss about (Score:2)
engineers have the power to say no to boss about stuff and have licenses on the line.
Re: (Score:2)
[...] we refuse to accept old, working stuff.
To me the situation has been exactly the opposite. I had a job where I had to fight to get old crapware rewritten because "it provably works" (although it has e.g. access after "free"). I have never seen an old software that would work with the new requirements in the new environment. Quite contrary, old software slowly but surely deteriorates with #ifdefs, code nobody dares to remove, hacks that just happen to work as they change timing, you name it. Just like good-old OpenSSL.
Same with bridges btw, 20th c
Re: (Score:2)
Software is often more expensive than the hardware it runs on, and yet you still have a warranty which provides repair/replacement in the event of physical defects but nothing in the case of software defects.
Re: (Score:2)
Re: (Score:2)
I find that a group of novices is just fine to work with as long as there is somebody with enough experience to guide them (in this case that somebody being myself)
Nobody sticks around longer than a week, huh?
Re: (Score:2)
Re: (Score:2)
If you consider engineering a process rather than results, it's only a joke to call it engineering in 80% of companies. I do engineering every day when I use an existing proven process to get a result, or use known solutions for security features, etc.
It's the people who ignore the known body of work who cause much of the trouble. And they seem to be in the majority. But it doesn't mean there is no software engineering being done.
Re: (Score:2)
Civil engineering is centuries old with more than a few huge heaps of rubble created when they pushed outside of their bounds of knowledge at the time.
We're starting to accumulate our own huge heaps of rubble. We call them the Obamacare Website and basically anything produced by PeopleSoft.
<ba-dum-bum>
Thank you, thank you, I'll be here all week. Tip the fish and try your waitress.
Re: (Score:2)
That would end the stream of crap in commercial software. Non-commercial software, on the other hand, would not cease to be produced the very second such a law was made.
Re: (Score:2)
> an opinion
An opinion doesn't require a solution, especially since it doesn't provide any facts to characterize.
There's no evidence that the security industry has been failing by adopting tools and methods that quite a few people use. The fact that there are few critical systems (that I use daily) which use username/password as the sole security credentials is a huge win over my experiences in '00. I think the security industry has pushed hard and made a serious dent.
Re:"an industry luminary" (Score:5, Informative)
Uh, Gene *IS* an expert. He was one of the first guys to dissect the Morris worm, for example. He's been around from the beginning.
http://en.wikipedia.org/wiki/Gene_Spafford [wikipedia.org]
Maybe you should go FIND a fuck to give.
Re: (Score:2)
Gene is one of the few people who became a "security expert" not because he called himself one, but everyone else did.
Re: (Score:2)
Gene?
It's been 20 years or so since I've known him, but does he no longer go by Spaff?
Re: (Score:3)
Re: (Score:2)
Even though I give you only a 2 on the Open Troll Scale, you made my head hurt enough that I feel the pressing urge to write a reply.
First of all, MS systems are surprisingly stable and secure. It hurts me to actually admit it (and I still say the main source for the security of Win8 stems from even malware writers not being able to figure the turd out), but MS has come a long way, its system offers a fair amount of stability and security and they are very quickly reacting to discoveries. Some of their "sol
Re: (Score:3, Interesting)
Well what else is there to do? The Security guys have to deal with a plethora of headaches, including demanding (but clueless) PHBs, commercial software houses whose idea of secure code is to patch it only after holes are found/exploited, and the need to make these things usable.
I mean, seriously - you can make something uber-secure, but you still gotta use the thing.
Besides, the most substantial underlying problem isn't the software, but the idiot behind the keyboard, and there's no fixing that.
Mind you, I
Re: (Score:3)
Software development requires balancing functionality and security with the amount of time and money you are willing to spend. Defining and enforcing internal basic safety related development guidelines on every project can help reduce the risk. Software has a relatively short shelf life. By the time you totally secure something you will be lucky if the software is still relevant. We have operating systems over 25 years old that are no where near 100% secure because the technology environment the software r
Re: (Score:2)
Re: (Score:2)
The problem is that we see it leak and we still pump more water into the tank instead of finally draining it and buying a new one.
Re: (Score:2)
You have to know WHICH 98% count, too.
To stay in the "health" analogy, me not having malaria medication can be acceptable or not, depending on whether I sit in Alaska or Zaire.
Target outsourced all / most / some of there IT (Score:2)
Target outsourced all / most / some of there IT
and it seems like at least that some of software alerts may of got lost at help desk India
Re: (Score:2)