Schneier on Security

Clive Robinson • August 21, 2023 5:34 PM

@ Winter,

“The consensus in the industry is that the internet and networking in general is build on open source.”

I don’t know where you dragged that myth up.

Reality is from the bottom up it’s “proprietary”[1] “closed source” all the way to the users keyboard down the MS or Apple routes.

Even if you run Linux on your PC, from your WiFi or Network card out and down it’s pretty much all proprietary “closed source”. But what about,

“What code runs in the PC?”

There is an adulterated and highly “proprietary” version of Minix running “over all” then just about every I/O device is “proprietary”…

And the list goes on and on and on.

Google for instance does not offer an “Open Source” system it actually forces a “closed ecosystem” as does Apple, as for Microsoft their in house expression “Embrace, extend, and extinguish”[2] tells you just how “proprietary” they want to be.

I think you need to have a rethink on your opinion as it does not appear to coincide with reality.

[1] See the intentional industry meaning of “proprietary” at,

http://catb.org/jargon/html/P/proprietary.html

In reality “proprietary” is generally a bad idea as it trys to force a “closed market” monopoly as Google and Microsoft have clearly done and Apple likewise. It’s why various governments have them all under investigation or active prosecution.

[2] The phrase “Embrace, extend, and extinguish” was originated as far as we can tell by Microsoft it’s self,

“”Embrace, extend, and extinguish” (EEE), also known as “embrace, extend, and exterminate”, is a phrase that the U.S. Department of Justice found was used internally by Microsoft to describe its strategy for entering product categories involving widely used standards, extending those standards with proprietary capabilities, and then using those differences in order to strongly disadvantage its competitors.”

https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish

Clive Robinson • August 22, 2023 2:53 AM

@ RobertT,

“but it does leave me wondering how much such a technology is really worth?”

Well… If we make some assumptions based on how little companies try to payout currently that is in fractions of a fraction of a percent of turnover the answer comes out not in billions but trillions.

As I’m guessing you’d worked out already.

As for,

“Is the relevant technology worth more to an attacker or a defender?”

It’s a good question but not easy to answer.

Their positions are very different with the advantage normally seen as been with the attacker.

It’s why in “physical defence” the “weak path strategy”[1] is often used to reduce costs, but it usually can not work with non physical systems[2]. With non physical security defence is mostly by obscurity or by trying to make the equivalent of a physical perimeter. More recently with lockdown causing significant homeworking trying to create a perimeter has become dificult thus the third of a century old idea of a “Bastion Host” loosely defined by Marcus Ranum has come back into play. The idea being “strip the junk and lock it down” hardening with full logging etc such that the attack surface is as small as possible and “monitoring” is high. Whilst that used to work well for properly administered servers, it’s always been an issue with user end machines. Which is why a number of VPN systems actually switched out the bottom of the communications stack and locked it to a single proxie host through which all traffic goes.

Appart from making defender costs more obviously higher, I get the feeling that on balance the attacker will find the enumeration phase of attacks benefited.

[1] The weak path strategy is based on human behaviour and the assumption/knowledge you will be attacked. Rather than the more normal you can deter attackers by not being the lowest hanging fruit which most physical security is based on. The idea is basically that you can significantly reduce opex by making one time capex. In times past you would find a physical location where an attacking enemy can only realistically approach from one direction and put your defence manpower there in delaying layers. Keeping the main body of defence in reserve doing other more gainfull activities. As an idea it does not workwell with non physical security where the “army of one” issue holds sway.

[2] Most non physical systems are difficult to impossible to effectively defend. The reason most consumer computers don’t get attacked but co-opted is that by and large,

1, It’s a target rich environment.
2, The returns are very small.
3, Target preselection is hard.

Clive Robinson • August 22, 2023 12:17 PM

@ JonKnowsNothing,

Re : We only count what we know.

Yes, have you looked at the link @Winter gave?

I had a look at the page he gave and became deeply suspicious, as there are various tells that it’s not exactly representative.

Then it becomes clear that the report is a marketing tool so in effect paints a picture, to get more business.

So I’d disregard it as any kind of actuall evidence.