This is a lightly edited transcript of my presentation today at the ACCSS/NCSC/Surf seminar ‘Cyber Security and Society’. I want to thank the organizers for inviting me to their conference & giving me a great opportunity to talk about something I worry about a lot. Here are the original slides with notes, which may be useful to view together with the text below. In the notes there are also additional URLs that back up the claims I make in what follows.
But then I decided, I wrote my own solution, a thing of 1,600 lines of code, which is, yeah, it’s like thousands of times less than the competition.
And it works. It’s very popular. … I got 100 emails from people saying that it’s so nice that someone wrote a small piece of software that is robust, does not have dependencies, you know how it works.
But the depressing thing is, some of the security people in the field, they thought it was a lovely challenge to audit my 1,600 lines of code. And they were very welcome to do that, of course. And they found three major vulnerabilities in there.
He makes a ton of excellent points, but the succinct impact of this little example really hit for me. As someone who often rewrites things so that I can both understand and fully trust in what I’m depending on, it’s always good to be reminded that you literally can’t write 500 lines of code without a good chance of introducing a major vulnerability.
The tech stack is so dizzyingly high today, and with so many interlocking parts, it continually amazes me that anything at all functions even in the absence of hostile actors.
Brenno, in 2013, predicted that we would only take cyber security seriously once we had the kind of incident where lots of self-driving cars, who can avoid pedestrians, that you flip one bit. And they all start aiming at pedestrians.
Oh Jesus we need to cut their internet access, fuck.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
He makes a ton of excellent points, but the succinct impact of this little example really hit for me. As someone who often rewrites things so that I can both understand and fully trust in what I’m depending on, it’s always good to be reminded that you literally can’t write 500 lines of code without a good chance of introducing a major vulnerability.
The tech stack is so dizzyingly high today, and with so many interlocking parts, it continually amazes me that anything at all functions even in the absence of hostile actors.
Oh Jesus we need to cut their internet access, fuck.
Anyone got a link for more info on this?
I think you mean wind turbines