Loading ...
Sorry, an error occurred while loading the content.

Re: Philosophical discussion of security (was: Re: [hackers-il] The wheel reinvention mystery)

Expand Messages
  • Nadav Har'El
    ... Are you looking for abuse? Posting on a heated subject, and in English, on the Hamakor list? I m not joining your game, and returning this to hackers-il.
    Message 1 of 5 , Sep 22, 2006
      On Fri, Sep 22, 2006, Omer Zak wrote about "Philosophical discussion of security (was: Re: [hackers-il] The wheel reinvention mystery)":
      > I am cross-posting this also to discussions@..., because the
      > altered topic is more appropriate to Hamakor discussions than to the
      > general philosophical atmosphere of Hackers-IL.

      Are you looking for abuse? Posting on a heated subject, and in English, on
      the Hamakor list? I'm not joining your game, and returning this to hackers-il.

      > > Also, people also tend about security as a binary thing, either there is
      > > "security" or there is "no security", and obviously "security" is better
      > > than "no security". In reality security is a broad spectrum, and there is
      > > *always* a tradeoff betwen more security at the cost of more money / less
      > > functionality / less convenience.
      > Yes. Please tell us what is your threat model and how (in your opinion)
      > should Hamakor deal with each threat.

      You (and the "first sysadmin" in question) is acting like Hamakor's site
      is some sort of unique site that needs unique protection. In fact, it and
      your "threat list" is hardly unique. The threats you list are the same for
      *every* web site: almost every web site wants not to be defaced, contains a
      bit of personal data, does not want to be taken over by spammers, and so on.
      So every "linux distribution", which already cater to web site builders,
      already take these threats seriously. They already have timely and automatic
      security updates, firewall, secure defaults, system-call firewall (i.e,
      "selinux"), rootkit and change detection, stack-smashing-protection and many
      other things.

      Indeed, you may argue that these measures protect against the "typical"
      threats, and may not protect against extremely dedicated and clever attackers
      with zero-day attacks up their sleeve. So what - are you expecting any of
      those to target Hamakor's site? If these attacks come on Hamakor ever, say,
      10 years, what kind of functionality/cost/convenience cost are you agreeing
      to incur in order to reduce their frequency to once every 20 years? (yes,
      this is what the security/functionality tradeoff looks like).

      Anyway, it appears you completely missed my most important point: perhaps
      *some* of this sysadmin's actions are (somehow) justified by security.
      But he hung *every* one of his actions on security, and you believe him
      implicitly just because of the word "security".
      For example, he refused to install Perl on the machine, stating that one
      interpreter (PHP) is enough, and having another one will open more holes.
      Really - do you seriously believe that? Perhaps one specific worm that depends
      on Perl will fail on a machine without Perl, but do you seriously believe
      that this will hinder a serious attacker for more than 5 minutes? How hard
      is it for an attacker to install Perl himself, if he wants Perl *that* much?

      And this "Perl" thing is just an example. It just goes to show you how easy
      it is for people (like you) do defend bizarre actions just because they were
      done in the name of "security" or have a weak smell of "security" in them.

      > A quick and dirty threat model is as follows:
      > 1. Membership information - should be guarded (even if a single person's
      > ID can be easily obtained by other means, we do not want to release the
      > IDs of 100 people, about 50% of them are successful).

      Most web sites in fact contain MUCH MORE sensitive data than Hamakor's
      membership list (which only lists 200 people and does not contain any
      financial information, credit card numbers, or anything even a bit interesting
      to crackers). The fact you're getting overworked by a "list of ids" is very
      strange, considering how you can find these ids everywhere: go to any
      university and see id lists hanging on the wall or used as computer user ids,
      for example. Lists (originally created for use in elections) of millions of
      Israeli citizens, their personal details and ids, are floating around with
      every criminal being able to get them.. Office buildings (like the one I
      mentioned) already take the physical id cards of thousands of "successful"
      (as you call them) people who come to the building, and can do with them
      much more than just copying the id numbers.

      > 2. Financial accounting - can be viewed, must not be tampered with.

      These have no business being on the Internet site, and never were on the site.

      Nadav Har'El | Friday, Sep 22 2006, 29 Elul 5766
      nyh@... |-----------------------------------------
      Phone +972-523-790466, ICQ 13349191 |Seen on the back of a dump truck:
      http://nadav.harel.org.il |<---PASSING SIDE . . . . . SUICIDE--->
    Your message has been successfully submitted and would be delivered to recipients shortly.