...and fruit flies like a banana.
A lot happened in the past year. I moved to San Francisco, survived being seriously hit by a car - facing a long, maybe a year, recovery... While at the hospital, I figured out a few things about life, universe, and everything. I won't reiterate those things here - I might sound as a buddhist nut if I do.
I will try to start blogging again, slowly. Among plans - translate the best articles drops.wooyun.org has on Android (my current fancy and job).
PS. In case I never gave out a link to my Twitter, it's @agelastic. Still struggling with typing, so most posts are retweets :)
Showing posts with label art of the start. Show all posts
Showing posts with label art of the start. Show all posts
Saturday, 10 October 2015
Tuesday, 8 October 2013
What is Security Anonymous?
First of all, nothing to do with the evil Anonymous, and quite a bit to do with AA's "twelve step" program.
The awesome Spaf recently reminded everyone (excluding people who work for one of the few very awesome companies that actually have a grip on their infosec) that no-one on the "defence" side cares about security enough to seriously change the situation.
Step one in the yet-to-be-written 12 step program: admit that "defence" side is not doing well (be honest with yourself):
Breaking things is thought to be sexier.
"User awareness" does not work.
Blinkenlights on products consoles don't give much reassurance other than psychological, or theatrical level.
Companies that thought they had security programs running well, find their source code dumped by the attackers on a random web server for unknown time.
Governments care mainly about how to break into their (or not) citizens' computers and backdooring crypto standards and implementations.
What's more, there is no "higher power" (see the original 12 steps) to appeal to. It's up to humble engineers who quietly do awesome stuff. I'll be posting about how others deal with their infosec challenges. No fluffy stuff, and probably no mention of "risk management," but you're welcome to convince me it works :)
What's even better, there will be drinkups! Because:
The awesome Spaf recently reminded everyone (excluding people who work for one of the few very awesome companies that actually have a grip on their infosec) that no-one on the "defence" side cares about security enough to seriously change the situation.
Step one in the yet-to-be-written 12 step program: admit that "defence" side is not doing well (be honest with yourself):
Breaking things is thought to be sexier.
"User awareness" does not work.
Blinkenlights on products consoles don't give much reassurance other than psychological, or theatrical level.
Companies that thought they had security programs running well, find their source code dumped by the attackers on a random web server for unknown time.
Governments care mainly about how to break into their (or not) citizens' computers and backdooring crypto standards and implementations.
What's more, there is no "higher power" (see the original 12 steps) to appeal to. It's up to humble engineers who quietly do awesome stuff. I'll be posting about how others deal with their infosec challenges. No fluffy stuff, and probably no mention of "risk management," but you're welcome to convince me it works :)
What's even better, there will be drinkups! Because:
Rules–particularly the dogmatic variety–are most useful for those who aren’t confident enough to make their own damn decisions.
For the rest of us, there’s vodka–so we can cope with the decisions we were foolishly wise enough to make.
So help us, Grey Goose.
Amen.
Subscribe to:
Posts (Atom)