LWN.net Logo

Security quotes of the week

When we mere imperfect mortals deem to pit even our most righteous beliefs against the timorous gods of old, it is simultaneously an act of faith and the voluntary assumption of enormous risk, for the gods of obsolescence still possess mighty powers indeed.

In the end, the old gods of information scarcity and control will indeed die, and more open models will win the future.

-- Lauren Weinstein

This vulnerability was different in that it was an 0day (and has been for some time) inside all the major malware dropper kits. And yet, no massive screaming has really been reported. People aren't really [panicking]. Just the same advice - boring even to people in the security industry. You have to wonder - is the level of public infection so high that something this pervasive doesn't move the needle?
-- Dave Aitel

That is to say, The Dictator's Practical Internet Guide to Power Retention's main value is not for dictatorships at all; it is written for us, citizens of the free world, as a wake up call against the various stakeholder that wish to subdue the Internet away from us. Be it ACTA, TPP, SOPA, National Security Inquiry, Patriot Act or just your average copyright industry demand, our Internet is always in danger – and thus our freedom is as well.
-- Moshe Reuveni reviews The Dictator's Practical Internet Guide to Power Retention

The larger story here is that as more of our communications move to mobile devices and to the cloud, we will encounter surprising exceptions to our expectations for secure communications. Browsers like Nokia Xpress and Opera Mini are essentially moving our web browsing to the cloud—pushing the security functions that we traditionally thought existed in a safe zone within our device to far-away servers. At the same time, our devices can betray us by aiding and abetting this security offloading.
-- Steve Schultze on mobile browsers decrypting SSL
(Log in to post comments)

Security quotes of the week

Posted Jan 18, 2013 12:02 UTC (Fri) by etienne (subscriber, #25256) [Link]

> Dictator's Practical Internet Guide to Power Retention

Good to read, other "advises":
- Do not let IPv6 enter your network, it will be a can of worm to identify the user of an IPV4 address.
- Get a mess with the copyright system, most people will get more "enjoyment", other will argue about license stuff for a very long time.

Security quotes of the week

Posted Jan 18, 2013 13:24 UTC (Fri) by nim-nim (subscriber, #34454) [Link]

Browser writers complain about “secret” MITM to compress HTTPS sessions, they complain about “broken” captive portals, but they're not expending a lot of efforts to permit explicit (user-approved) HTTPS proxies or to implement HTTP error 511 (to replace broken captive portals).

As a result every big infrastructure provider is routing around browser stupidity with those hacks. Do anyone still thinks refusing to acknowledge https proxies and captive portals exist will make them go away?

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds