If Architects designed buildings the way that programmers write software, the first woodpecker that came along would destroy civilization

Peter finds a real humdinger of a security post: why is software security so broken?

Libpurple was written by people who wanted their open source chat client to talk to every kind of instant messaging system in the world, and didn’t give a shit about security or encryption. Security people who have examined the code have said there are so many possible ways to exploit libpurple there is probably no point in patching it. It needs to be thrown out and rewritten from scratch. These aren’t bugs that let someone read your encrypted messages, they are bugs that let someone take over your whole computer, see everything you type or read and probably watch you pick your nose on your webcam.

This lovely tool, OTR, sits on top of libpurple on most systems that use it. Let me make something clear, because even some geeks don’t get this: it doesn’t matter how good your encryption is if your attacker can just read your data off the screen with you, and I promise they can. They may or may not know how to yet, but they can. There are a hundred libpurples on your computer: little pieces of software written on a budget with unrealistic deadlines by people who didn’t know or didn’t care about keeping the rest of your system secure.

My only criticism of this post is that it isn't terrifyingly pessimistic enough.  If you boot it, they will come.  Remember, you're reading this from a computer screen right now.

Software secure is wretched.  Sometimes it's wretched because nobody cares.  Sometimes it's wretched because, well, because you recompiled a program for a 64 bit architecture (rather than a 32 bit one) and without changing a line of code now everyone can pwnz0r you*.  It's a little known fact that Nazi Germany fell because of a failure of cyber security.



But back to the post that Peter pointed us towards.  This is absolutely correct:

Security and privacy experts harangue the public about metadata and networked sharing, but keeping track of these things is about as natural as doing blood panels on yourself every morning, and about as easy. The risks on a societal level from giving up our privacy are terrible. Yet the consequences of not doing so on an individual basis are immediately crippling. The whole thing is a shitty battle of attrition between what we all want for ourselves and our families and the ways we need community to survive as humans — a Mexican stand off monetized by corporations and monitored by governments.

Even classified networks get hacked.  I'm still the #1 Google result for "How to hack a classified network"**.  If the Defense Department - with all their skilled security d00ds and financial resources - if they can't keep themselves safe, then what chance do you have?

The answer, of course, is slim to none.  And Slim just left town.

I've worked in this technology space since 1985.  Quite frankly, I'm not sure what to tell you to help yourselves out.  I wish I had a better answer, other than "never do anything consequential on the 'Net".  And that absolutely, positively means never bank online.  Or vote online.  Of have a car with a computer in it.  Or a "smart" gun.

Riddle me this, Security Man: what do you get when you cross a car with a computer?  Answer: a computer.  Go read the post that Peter points us to.  Re-read it until the hair on the back of your neck stands up, and a shiver runs up your spine.  At that point, you will understand the situation precisely.

If ignorant both of your enemy and yourself, you are certain to be in peril.

- Sun Tsu

Good morning.  ;-)

* I'm actually pretty proud of this post, which is from when I'd only been blogging a couple months but already a distinctly Borepatchian style had emerged.

** Another pretty good security post from the early days of this blog.