Schneier on Security

Clive Robinson • April 5, 2013 5:44 PM

@ Civil Libertarian,

Security issues are often treated more as a marketing challenge than an engineering one.

Which is another way of saying from an economic perspective for these organisations security is an “externalality”.

Sadly this is nothing new, it does not matter how many dollars security saves a customer or other party, not one cent will be spent on it by the companies developers as long as senior managment see no profit in it.

It was this sort of thinking that gave rise to cars flipping over at 30MPH when cornering and others exploding in a fireball when rear end shunted etc etc, which gave rise to the “Lemon Laws” that flipped the externalality back into the company.

I know a lack of regulation is a “libertarian dream” but the real life waking nightmare of it is organisations externalising issues which is just one of those steps along the footpath that gives rise to “a race to the bottom”.

A race to the bottom almost always destroys a viable market, by taking out profit for the seller and confidence for the buyer and others. Oddly “appropriate regulation” (history has shown us) actually makes the market more profitable and viable for both the seller and buyer as well as other third parties involved such as insurers…

The question then becomes “What is appropriate legislation?” and currently due to various peculiarities of “information markets” this is a very difficult question to answer.

Clive Robinson • April 6, 2013 4:41 PM

@ Massimiliano Lincetto,

Yes it’s a bit silly of the French authorities, they could just have gone in and re-edited it etc etc which would have made the problem go away with little noise.

Now however their “National Security” actions have been heard outside of their jurisdiction, and the chances are likewise the offending pages have been cached outside their jurissdiction as well.

Which means there is a fair old chance that the information will re-surface again on a non French Wiki somewhere.

It would appear that one of the French Wikipedia Sysops has already re-iinstated the article (but with some changes) so the chances are the changes will highlight the parts the French authorities don’t like, making the problem even worse.

I know France has a bad reputation about “due process” etc but the authorities should by now realise there is always going to be blowback when they do things in such a ham fisted manner against what is in effect a global volunteer network (think back to the sinking of the Rainbow Warrior).

Clive Robinson • April 7, 2013 5:23 AM

@ Ac2,

Interesting article on the Spamhaus DDOS attack

As one of those with interests involving the London INX all I can say is the effect of the attack was marginal at best, which is good news for users as it shows that packet storms of the deliberate type can be catered for.

But the article does provide an interesting read for those more concerned with Internnet Surveillance as it shows ways of moving traffic to and away from choke points that have been the natural home of the gatherers. That said there is not a lot of published info on Tier1 and Tier2 interconnects so finding where to put your nodes to excercise the desired low risk paths around potential surveillance points is going to be hard won knowledge.

Mind you the whole event does rise a question about resilience… Ask yourself if there are other infrastructures we absolutly rely on (power, water, roads etc) that are anything as close to resiliant or for that matter capable of reparing themselves so quickly…

Clive Robinson • April 7, 2013 5:01 PM

@ paranoia destroys ya,

Any updates on the FTC robocall challenge?

Not unexpectedly it’s all gone horibly wrong for Steve Bellovin and Co.

It would appear the two winning solutions are anything but viable solutions for various reasons and actually based on ideas belonging to other people (who have the right to patent etc).

So all the challenge has realy produced is controversy and embarrassment for the FTC.

In the meen time RoboCallers are moving from strength to strength.

The actual solution has been known for many many years I even wrote up a proposal to implement it and manufacture it back in 1992 when I was working in the Telcomms FMCE industry and I believe there are already patents to that effect.

Interestingly those who wrote a popular VoIP system have provided a working solution as well based on the same idea…

The real problem iis the supposed “legal RoboCallers” and here the FTC has obviously bowed to political pressure rather than allow all Robo Callers to be blocked at the recipients discretion.

Clive Robinson • April 9, 2013 2:30 AM

@

I fear that my moniker gave the wrong impression.

In this case your fears are groundless. I kind of work on a backwards version of the old rhyme,

Sticks and stones may break my bones but names will never harm me”

Needless to say he had quickly learnt to say “Zero Zero Seven Sir” rather than “Double Oh Seven Sir” but even so some first muster parades did have badly suppressed laughter etc.