tag:blogger.com,1999:blog-4088979.post4399103638769024715..comments2023-10-16T06:06:25.012-04:00Comments on TaoSecurity Blog: Response to Is Vulnerability Research Ethical?Richard Bejtlichhttp://www.blogger.com/profile/13512184196416665417noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-4088979.post-63355997045703109042008-05-24T20:41:00.000-04:002008-05-24T20:41:00.000-04:00Spaf, thanks for your comment. To summarize -- yo...Spaf, thanks for your comment. To summarize -- you think we could learn from mistakes and make less vulnerable products, but it's not done because that approach is cost prohibitive? <BR/><BR/>I agree with that for certain classes of problems, but for others it seems developers are just not adopting simple, cheap practices -- like disabling unnecessary services.Richard Bejtlichhttps://www.blogger.com/profile/13512184196416665417noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-29693784563701818702008-05-24T17:21:00.000-04:002008-05-24T17:21:00.000-04:00I wish I'd seen Marcus's comments earlier -- good ...I wish I'd seen Marcus's comments earlier -- good point.<BR/><BR/>Basically, what it comes down to is that we are buying soft widgets at the big box store, then poking at them with sharp sticks to see when they fall over. The company then sends us a patch for sharp stick pokes such as that. And the people continue poking. The people with the best luck poking with the sticks are anointed as "Expert Stick Pokers" by the crowd. Some don't have much luck with their sticks (too thin) and so they proclaim that the widget looks pretty sturdy to them, and besides, the combination of crowd and suppliers finds and produces fixes pretty darn quick.<BR/><BR/>But almost nobody in the crowd recognizes that it was a cheap widget, it never claimed to be immune to sharp sticks, and even chimpanzees could have some success if they picked up one of the long sticks. Hardened widgets used to be available, but they were expensive and non-portable, so people stopped buying them. Now there is a large market in light, portable widgets -- that continue to fall over, and sometimes hurt people in the process. <BR/><BR/>Nonetheless, the crowd goes back to the store when a new widget is released -- now with blinking lights, chrome, and 897 new soft spots that shouldn't be poked with sticks. And while they're there, they'll buy a roll of aluminum foil to wrap the widget in to keep it safe from sticks -- at least from soft ones. And the government leads the pack because their procurement orders specified a widget of precisely that shape at the lowest possible cost.<BR/><BR/>So, nearly everyone can buy widgets (and aluminum foil), they all grumble about their quality, and they ooh and aah at the exploits of the stick wielders. And almost no one -- government or industry -- bothers to invest in how to build stronger widgets, because, after all, we're used to the current ones, punctures and all.<BR/><BR/>It's definitely not sound engineering or sound business practice.<BR/><BR/>Keep on with the good blogging!Anonymousnoreply@blogger.com