Schneier on Security

Clive Robinson • January 3, 2020 5:16 PM

@ Bruce,

surreptitiously steals

Whilst being a nice turn of phrase, it is also a symptom of the way the industry is.

If code was plain language and openly available, people could sit down and read through it in much the same way they could a book. They could draw little diagrams etc, and in short play at being “A pencil and paper computer”. Then in most cases the word “surreptitiously” would not be the word of choice for such behaviours.

When you have no choice but to use a block of code “sight unseen” there is little you can do unless you have reasonable experience in fault finding and black box testing thinking. All anomalies you see from expected behaviour you would treat like a fault and with skill and a little luck on selecting inputs to the black box determin what the anomalous behaviour does or what it is related to.

Such skills are in short supply at the best of times, thus you would have thought they would be much sort after. But mainly they are not, infact often they are not just expressly not wanted they are legislated against.

Thus an environment is in effect created where criminality is rewarded because others take themselves and their often mediocre ideas to seriously and think they have invented a better mousetrap for which the world will pay handsomely. In reality the ideas are usually neither original or unique and at best “borrowed” from others without any acknowledgment. Some would call this theft and there is legislation to this effect, but you have to break the law to prove you’ve been stolen from…

Thus with even Microsoft having been caught and punished committing such theft the question arises as to “Who can you trust?”

The answer would appear to be “no one”, unless you have sufficient leverage against them, and even that is by no means a sure fire thing.

I personaly do not do online commerce my only dalliance in that direction was with Amazon and they stole from me, so lesson learned at a small price.

The one thing I have learned over the years is no matter how long a chain of verifiable trust there is, it has two ends and beyond there neither verification or trust can be established.

Thus the question arises of “Can a system be designed where all that requires trust and it’s verification be achived within the chain?” and so far the answer appears to be “no” and that there is “no way yet known to change that in practical systems”.

Clive Robinson • January 4, 2020 11:42 AM

@ RRIck,

If you install an app called Shitcoin, that you downloaded from some random site on the internet, and then use that app to manage your finances / private keys / etc, and you type all your secrets into it without questioning it at all, at what point do you deserve what comes next?

The problem is as was recently denostrated with ToTok, even if you download a well talked about and praised application that appeared in both Apple’s and Google’s walled gardens. Which is taken by many to be a sign of approval as some form of code review by supposed experts has taken place… You can still be well and truley invited to the “carless elevator ride”. Which brings us back to your question of,

at what point do you deserve what comes next?

I would say based on the evidence available from “built in in the supply chain”, “loaded from walled gardens”, and even “drive by” attacks the answer is,

When turning on the power switch.

Or shortly there after.

The point I made up at the top of this thread of,

Thus with even Microsoft having been caught and punished committing such theft the question arises as to “Who can you trust?” The answer would appear to be “no one”, unless you have sufficient leverage against them, and even that is by no means a sure fire thing.

Thus “blaim the victim” reasoning is not just avoiding the real issue, but is in effect creating a strawman argument.

The fault lies squarely with two sets of people,

1, Those who develop the bad code.
2, Those who publish the bad code.

Thus the real hard question is,

How do you stop or spot any bad code before it does harm?

As I also noted above about verified trust chains,

Thus the question arises of “Can a system be designed where all that requires trust and it’s verification be achived within the chain?” and so far the answer appears to be “no” and that there is “no way yet known to change that in practical systems”.

If you can think of a solution a lot of people would be rather more than interested.

Clive Robinson • January 4, 2020 7:15 PM

@ Sheilagh Wong,

… but if you’re computer’s operating system isn’t secure your data isn’t secure.

It’s funny how people don’t get what an “end run attack” is, or why your security end point needs to be beyond the communications end point, preferably “off device”

Somebody mentioned Moxie Marlinespike would be at CCC [1] giving a talk, I wonder if anyone will ask him if he understands it yet 😉

[1] https://fahrplan.events.ccc.de/congress/2019/Fahrplan/speakers/9742.html