 |
privacy |
||
|
Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.
Blog Feed Recent Items 
The nfoCentrale Blog Conclave nfoCentrale Associated Sites |
2005-04-14TRUST 2: Proliferation of COTS in Critical InfrastructureACM News Service: Diffie - Infrastructure a Disaster in the Making. This summary features Diffie's perspective on the current distractions from attention to the infrastructure, the rapid introduction of software that is not designed for such reliability, and the inevitability of PKI adoption, like-it-or-not. Bill Brenner's 2005-04-12 SearchSecurity.com article is the second of two parts. This Diffie interview has some valuable context. For example, Diffie doesn't go for the monoculture theory, recognizing the practicalities that also figure into security approaches. Known for insightful gems, Diffie drops this keeper: "... Diversity isn't the most critical question. It's the proper attention to software coding that's critical. Security differs from reliability because someone's looking for the part you didn't get right." [dh: My emphasis] The article is too short. The sensibilities expressed here resonate for me and I want more! It's great to see Diffie anticipating direction and that suggests where I can concentrate on simplified use in my own cryptographic applications. And we get more Diffie humor:How do you see the technology evolving over the next decade?I find that encouraging. I will find it more encouraging if the shake-out doesn't leave us with protocols that require a business model that fore-closes cottage innovation. Martin Hellman's part of the interviews appeared on 2005-04-11, and the Diffie-Hellman key exchange algorithm is presented in a 2003-01-23 article by Mike Chapple. Brenner also has a 2004-07-01 article on differing views of the monoculture threat. That one demonstrates to me that the metaphor is too pat. Software platforms are clones, so it isn't even a monoculture in that regard. One disease kills all. But true diversity (in the Darwinian sense) is not possible for software, and it is also not useful. Species survival doesn't matter if most of your copies die in the plague. Get it? And contrived-diversity forms being proposed raise their own trustworthiness concerns. For one: How do you turn in a bug report against an operating system that has genetic variations in the copy you are running? The medical profession seems to handle that well enough, but how do you give your computer two aspirin? Digital failure of the software kind is not like having a few cells die while antibodies do their thing. The monoculture idea is catchy and only a metaphor with the destiny of all metaphors when over-applied. I am delighted to learn of. SearchSecurity.com. I am also amused by how strongly the site puts my software firewall through its paces, and how they track my every move as I navigate around. I love all the little boxes with [ad] in them. Even more exciting are the rectangles on the page with browser warning pages scrunched into them, telling me that I am not authorized to browse a page and giving me a 403 response. I have finally figured out this is provoked by in-line MIME types. And of course my browser blocked the third-party cookie from bitpipe.com. I wonder how much more thrilling life will be if I register for the free membership? Not today, thank you very much. What's amusing about all of this is that this is exactly the way I find Microsoft to be at cross-purpose with itself. The market-facing side, illustrated by MSN, is busily expecting us to drop all of our safeguards to enjoy the experience they and their advertisers have in store for us, while the security-facing side is ragging us to practice the 3 whatnots, protect ourselves, update as often as we brush, etc., etc. The more I run into this, the dirtier I am beginning to feel. We are making ourselves crazy with this sick combination of security righteousness and base mercantilism. (Actually, I think I am giving mercantilism an undeserved bad name, but we are being taken a long way from dealing with the country storekeeper, and I don't have a better label.)
|
||
|
You are navigating Orcmid's Lair. |
template
created 2004-06-17-20:01 -0700 (pdt)
by orcmid |