[stouset]

Part of this is that nobody has cared about security since the beginning, for basically anything in tech.

It’s an industry-wide issue that permeates every level of the stack. And so yeah, individual companies trying to retrofit security onto a jenga tower of technology is going to have to spend a ridiculous amount of resources to have any kind of impact.

I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon.

[ryandrake]

> I don’t know what the answer is, but I too believe things won’t change until the day someone figures out how to push a “kill all humans” OTA update to all the self-driving cars on some random Tuesday afternoon.

Even in that case I’m pessimistic that any action will happen. People will go on TV and say grave things, hearings will be held. Fingers will be pointed. Task Forces will kick off. Reports will be written. Bureaucrats will have stern conversations with bureaucrats. Politicians will say: we must this and we shall that. IT companies will sell their “solutions”. But no actual action will happen. It will be all talk and commerce but no actual hands unplugging and plugging in cables. We have completely lost the societal will to actually do anything besides generate words and reports.

[eastbound]

You are describing the current world, where politicians dissolve issues. There’s a saying in Europe that no minister of defense was ever nominated. Real ministers of war, when there is war, appoint themselves into position.

When there is a real problem, people act upon it (assuming society is functional - otherwise the country simply dies). That’s why there is no better training for war than war itself. Ukraine has already unrooted all of the peace & love & no armament folklore in France, and even turned a lot of ecologists into pro-nuclear voters.

So yes, I wouldn’t be surprised if guarantees of offline mode (with regular drills) were passed into law for electric cars and everything cloudy, including IntelliJ.

[vbezhenar]

> Part of this is that nobody has cared about security since the beginning, for basically anything in tech.

> It’s an industry-wide issue that permeates every level of the stack.

Can you explain? I don't understand. Here's my take.

Let's start from the bottom of the stack. CPU has some good security protections. They have ways to ensure that boot code is signed. They have hardware protection for memory. They have memory encryption to isolate VMs. They have many amazing security technologies. I can run VM inaccessible by host.

Let's move to OS. Well, there's lot of security stuff in any OS. Process isolation, namespace isolation, encrypted storage.

Next level is container orchestrator which happens to be Kubernetes these days. Again, there's lots of security stuff there. Built-in and add-ons. Everything is authenticated with cryptography. Many ways to implement very granular secret sharing. Secret stuff is encrypted in-rest.

Next level is application framework. Can't tell for every framework, but all frameworks I've seen so far was quite security-cautious. They try to safeguard known security issues (like SQL injections), they make it easy to add security layers on top, and so on.

Nobody cared about security in 1984, I guess. That's not the case anymore. Everyone cares about security. May be there's still space for improvement.

The only people who don't care about security are end-users. They don't even know what security is. They don't care about their passwords. They don't care about sharing their access. They don't care to check domain before typing password.

Also some application developers don't care much about security, that I admit. But that's not the every level of the stack. That's the last level of the stack.

[mikewarot]

>Let's move to OS. Well, there's lot of security stuff in any OS. Process isolation, namespace isolation, encrypted storage.

How can the user run some random application and not have it wipe out their OS? Can they plug in a random USB stick safely?

There's no real security in the OS part of the stack, but lots of security theater.

[HeatrayEnjoyer]

What app on my phone could delete the OS? It isn't even possible. It can't even delete normal user files without explicit file access permission.

[mikewarot]

Both iOS and Android have had zero day exploits announced this year, what makes you think they've all been found?

[HeatrayEnjoyer]

Zero days capable of nuking the OS are not going to be found in random apps or malware. Anyone with that kind of ability will be using it for nation-state targeted intelligence ops, not wasting it on random individuals.

[vilunov]

Who runs container orchestrators on phones?

[indymike]

Security wasn’t really a design consideration especially in the one use one PC era. We’re still trying to secure hardware and software descended from that era.