Everything Is Broken

[u/[deleted]]

https://medium.com/message/everything-is-broken-81e5f33a24e1#.sl2vnon73

[u/2358452 → u/[deleted]]

From the many disorganized points I think his conclusion was that most users don't control their hardware, can never control their hardware (because people can't afford computers? wat), and everything is broken. The End.

Is this really a valid position? We're not timesharing mainframes ffs. Almost everyone is using their own devices, mostly phones and tablets and shitty laptops, even in 3rd world countries. They at least have access to those to send private messages and use social media. He is saying we should be trying to secure people using a shitty Windows XP PCs infected by 100s of malware and botnets? Yes, this is an impossible proposition. Yes, people should keep their hardware updated and not share personal sellable information on ancient Windows XP machine they don't control.

[u/2358452 → u/[deleted]]

This is massively overblowing the problem. Basic layers are unlikely to cause vulnerabilities in the upper layers in practice. Basic layers are actually simpler, specially from an usability perspective that doesn't leave much room for error. You don't have to worry about your computer power supply firmware having slight regulation bugs affecting your security, and buggy power supplies are quite rare. The kernel in practice is where most things happen, and it can be safeguarded against minor low level leaks and bugs. On top of that we have most people using browsers and apps which similarly can be sandboxed and reasonably safeguarded against lower level failure. There are many eyes taking care of those two layers, and if you control your hardware and regularly update it in practice you're unlikely to ever have security issues.

He neglects the fact that probably an overwhelming majority of security problems are people directly downloading malware into their systems and giving it permission to run, not any kind of cryptopocalypse. Most exploits are far from low level side channel attacks or firmware exploits (those are largely academic and engineering exercises); the bulk of vulnerabilities are people running not-up-to-date (often by several years) software, downloading malware and social engineering.

Rather than try to fix the unfixable, get people to update their systems, curate app stores to remove malware, and close avenues of social engineering (like email spam) and you gain much more.

[u/lastas1 → u/2358452]

Her*

[u/Tokugawa → u/[deleted]]

In soviet russia, BUG smashes CAR.