full-disclosure - Re: Securing our computers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 04 Nov 2008 05:07:17 +0700
From: Pavel Labushev <p.labushev@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Securing our computers?

mcwidget ?????:
>     What we *don't* know how to do is make a system that Joe Sixpack is
>     allowed
>     to screw around with, and yet prevent security issues from happening. 

It's not a user's fault that C-like languages' runtime is vulnerable by
design. And it's certainly not a user's fault that C-like languages are
being widely used.
It's not a user's fault that most of widely used hardware platforms and
OSes are lacking of any advanced secure task isolation. And it's
certainly not a user's fault that the currently available isolation
functionality is being misused and overestimated everywhere.
It's not a user's fault that most of widely used software, including
OSes, and protocols has been designed and implemented mostly without
security in mind.

It's mostly the industry's fault. And the industry earns much from it.
I wouldn't blame users, because they are a minor evil in this story.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/