full-disclosure - Re: New paper on Security and Obscurity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: gadgeteer at elegantinnovations.org (gadgeteer@...gantinnovations.org)
Subject: Re: New paper on Security and Obscurity

On Wed, Sep 01, 2004 at 07:02:18AM -0400, Dave Aitel (dave@...unitysec.com) wrote:
> The paper itself is academic fluff. It's not your fault, it's just that
> you've never written an exploit and have no technical background, so
> you've got a keyhole view into a large issue. Example:

network rule

[...]
> It might be good to focus on what's really different, instead of trying
> to make up analogies or meaningless equations. If your paper cut every
> paragraph starting with "Consider an analogy from the physical world"
> then it would be much better off. Your fundamental conclusion, that
> "there is no logical or necessary difference between cybersecurity and
> physical security" is simply wrong. There are many logical and necessary
> difference based in information theory for why the two are completely
> disparate. Do you know if you got hacked today? Do you know if I stole
> your chair today?

(1st paragraph p. 27)
This paragraph is soooo wrong.  The only people who might try to defend
such falsity are CEOs, CTOs (etc) of proprietary software companies.

There is an analogy about "fishing for vulnurabilities" that is passed
around in computer security circles.  It is a good one because it
provides some insight without invoking a lot of baggage.  OTOH, your use
of "machine gun nests" drags an entire baggage train behind it.

Another sign to look for when re-writing your paper is the 'intitution'.
The content of human intitution is an extremely variable thing.  It is
based on the experience and training of the particular human in
question.  An example is 'folk physics' AKA "commonsense" physics.  It
only works at macroscopic scale on the surface of Earth without extreme
conditions.  Outside of this narrowly defined box it falls flat.

> When papers like this affect legal doctrine, they are extremely harmful.
> You should consider not publishing it.

I agree with Dave on this very strongly.
-- 
Chief Gadgeteer
Elegant Innovations