Security quotes of the week

[Posted August 5, 2015 by jake]

If it sounds like the people who designed this e-safe ignored all of the things we've learned about computer security in the last few decades, you're right. And that's the problem with Internet-of-Things security: it's often designed by people who don't know computer or Internet security.

— Bruce Schneier

Which is: you don't chase and fix vulnerabilities, you design a system around fundamentally stopping routes of impact. For spender [Brad Spengler] it is eradicating entire bug classes in his grsecurity project. For network engineers it is understanding each and every exfiltration path on your network and segmenting accordingly.

Containment is the name of the game. Not prevention. The compromise is inevitable and the routes are legion. It is going to happen.

— Bas Alberts in an interesting rant (Thanks to Paul Wise.)

It's worth noting at this point that if Google had tried a stupid stunt like this, there would likely already be EU commissioners running through the streets of Brussels hoisting pitchforks and flaming torches, all yelling for Google's blood.

For a while there, it was starting to look like there indeed was a new kind of Microsoft coming into view, one that had evolved beyond the hubris that had so long been Microsoft's single most defining characteristic.

As we can see, any such hopes are now ... Gone with the Win10.

— Lauren Weinstein on Windows Update Delivery Optimization

Or you can root your phone and install the excellent and more swiftly updated Android-based operating system CyanogenMod on it. This is a good alternative, but it’s not trivial to install CyanogenMod, and updates for certain phones depend on volunteers, so, again, you might not get them as soon as you’d wish.

Or, lastly, you can give up, switch to Apple and buy an iPhone.

As much as my old self will hate me, I’m going to choose the last option.

— Lorenzo Franceschi-Bicchierai

Security quotes of the week

Posted Aug 6, 2015 2:28 UTC (Thu) by kjp (guest, #39639) [Link]

Fascinating about the p2p windows update. What wasn't mentioned is that connecting to another random computer could be flagged as suspicious (OTOH, it's plausible deniability) Anyone with an educated, back-of-napkin estimate of M$ global update bandwidth costs?

Security quotes of the week

Posted Aug 6, 2015 2:33 UTC (Thu) by sciurus (guest, #58832) [Link]

Google had announced a new security update schedule for Nexus devices.

http://officialandroid.blogspot.com/2015/08/an-update-to-...

Buy a One Plus phone

Posted Aug 6, 2015 12:30 UTC (Thu) by tsr2 (subscriber, #4293) [Link] (1 responses)

You can buy a CyanogenMod phone called the One Plus. Probably a much better option than an iPhone.

Buy a One Plus phone

Posted Aug 6, 2015 13:22 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

Doesn't work on all providers though. Myself, I'm looking forward to the Moto X Pure (since I did like the X quite a bit, but it is bootlickered on Verizon, so I went back to my Galaxy Nexus; haven't been back since the Nexus 6 was released though).

Security quotes of the week

Posted Aug 6, 2015 16:28 UTC (Thu) by ortalo (guest, #4654) [Link] (12 responses)

Why would Apple be better at protecting their endusers' interests than Google?
Note the converse doubt also holds of course. Lack of knowledge does not mean lack of problems.

Security quotes of the week

Posted Aug 6, 2015 20:01 UTC (Thu) by davidstrauss (guest, #85867) [Link] (2 responses)

> Why would Apple be better at protecting their endusers' interests than Google?

I'm primarily a Google user, but I know that Apple's primary revenue comes from their users and device sales. Google primarily profits from advertising. Apple's model definitely provides more incentive to protect end-user interests in terms of privacy and security.

Security quotes of the week

Posted Aug 6, 2015 22:16 UTC (Thu) by spender (guest, #23067) [Link] (1 responses)

Not just primarily, overwhelmingly: 90% of Google's revenue is from advertising: http://www.statista.com/statistics/266249/advertising-rev...

-Brad

Security quotes of the week

Posted Aug 7, 2015 10:10 UTC (Fri) by ortalo (guest, #4654) [Link]

So Apple may have a bigger interest than Google in its customer base *believing* that they are secure. You may have a point. But I suppose you will understand that I want to underline that some beliefs do not imply proofs.

In my opinion, final customers (and market share issues) cannot directly be the incentive, they do not have the knowledge to evaluate their device security.

Security quotes of the week

Posted Aug 6, 2015 23:13 UTC (Thu) by error27 (subscriber, #8346) [Link] (8 responses)

Apple controls all 10 models of iphone/ipad so they are able to push updates but Google doesn't control the 19,000 models of of Android devices.

Security quotes of the week

Posted Aug 7, 2015 0:12 UTC (Fri) by sjj (guest, #2020) [Link] (7 responses)

Yes, see Ars Technica today: http://arstechnica.com/gadgets/2015/08/waiting-for-androi...

According to the article, about 2.6% of Android devices are going to get an update for the stagefright vulnerability, ever. Google itself supports a couple of latest Android versions, but OEMs and carriers don't even push those out if they can avoid it. It took Microsoft at least 15 years to get to their current update model. Win10 will force updates. Neither Google, carriers, or Android OEMs have any incentive to make customer data security a priority, they prefer to sell customer data to advertisers and new handsets every two years.

It is a mess and I've found myself browsing for iPhones too lately (which I thought I'd never do). Apple's business model isn't selling customer data (as much?).

Yeah, I could use some hacker friendly ROM on Android, but I have a finite amount of round tuits and I'd rather try to keep my desktop Linux self-flagellation going.

Security quotes of the week

Posted Aug 7, 2015 1:05 UTC (Fri) by dlang (guest, #313) [Link] (5 responses)

> Neither Google, carriers, or Android OEMs have any incentive to make customer data security a priority, they prefer to sell customer data to advertisers and new handsets every two years

Google has an incentive to increase security because if Android looses market share they will loose advertising (even if you assume that their intent to keep other companies from getting a stranglehold on user devices is a meaningless goal since you don't see them earning any revenue from it)

Carriers and OEMs don't have a strong incentive to provide updates, but as soon as some start providing updates, the others will either have to follow along or users will start seeing problems that their friends don't se.

This is why the Samsung and google Nexus monthly security updates are so important. Even if they don't last as long as we would like, it still sets the stage for ongoing maintenance and gets people used to the idea that they are owed updates.

There's a chance that having to provide security updates to multiple different versions will provide enough incentive to get carriers/OEMs to upgrade older products to new versions to reduce their maintenance burden.

(yes, I'm an optimistic cynic :-)

Security quotes of the week

Posted Aug 7, 2015 2:46 UTC (Fri) by sjj (guest, #2020) [Link] (1 responses)

Optimism, nice ;-)

So this new process is going to go Google > OEM > carriers. Sounds like fun when both OEMs and carriers have their own versions of OS mods. At least there is some pressure now to do the right thing. The majority of devices out in the wild will not get updates AFAICT.

I'm just waiting for Samsung to advertise their new phones with "gets security updates", unlike the one bought six months ago. I'm a pessimist cynic, sorry.

Security quotes of the week

Posted Aug 7, 2015 3:09 UTC (Fri) by dlang (guest, #313) [Link]

> So this new process is going to go Google > OEM > carriers.

that's what the old process was as well, just that the OEMs and carriers mostly didn't do any updates (and Google, somewhat understandably, doesn't do many updates to old versions)

Security quotes of the week

Posted Aug 13, 2015 7:56 UTC (Thu) by Wol (subscriber, #4433) [Link] (2 responses)

> There's a chance that having to provide security updates to multiple different versions will provide enough incentive to get carriers/OEMs to upgrade older products to new versions to reduce their maintenance burden.

Part of the trouble is that most Android phones (all?) are arm-based. And the arm driver tree needs a massive cleanup. Chances are, your phone (with the exact same chipset as mine) uses a completely different set of drivers to mine.

Once the work sorting that mess out is complete, it will be much easier to roll out updates, because it will be a lot easier to sort out what's going on.

Cheers,
Wol

Security quotes of the week

Posted Aug 13, 2015 12:34 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

> Part of the trouble is that most Android phones (all?) are arm-based. And the arm driver tree needs a massive cleanup.

No, it's not that the "arm driver tree needs a massive cleanup" -- it's that the *manufacturers* of the handsets, platforms, and SoCs need to (first) actually release source code and (ideally) put forth the effort necessary to get that code into the mainline kernel. Only then can the mainline kernel be expected to support things sanely.

Security quotes of the week

Posted Aug 13, 2015 22:52 UTC (Thu) by Wol (subscriber, #4433) [Link]

As I understand it, even the drivers in the mainline kernel suffer from this mess :-(

Too many companies HAVE released their drivers as open source, by tossing them over the wall. And they are heavily garbled versions of other drivers, which are garbled versions of yet other drivers, and it's turtles all the way down ...

I gather a lot of work has been put in to cleaning this mess up, but I got the impression it's not complete.

And that's why DeviceTree is necessary - unlike on x86 where MS pretty much forced standardisation, on arm there is no way to probe and identify hardware because it's far too easy for a probe for device A to crash device B - not a good idea. Once DeviceTree is in place, I think you will just have to give your linux kernel the tree, and it will know what hardware is where in the memory map, which will make driver management much easier.

Cheers,
Wol

Security quotes of the week

Posted Aug 8, 2015 3:12 UTC (Sat) by ploxiln (subscriber, #58395) [Link]

Why must we choose between no updates and forced updates? Why not debian-style updates: available in a day or two, install whenever I want, install a previous version whenever I want.

Oh, mass market, right...

Security quotes of the week

Posted Aug 7, 2015 5:29 UTC (Fri) by cstanhop (subscriber, #4740) [Link] (3 responses)

Are any distros working on p2p updates? Seems like something that could help alleviate strain on community resources.

Security quotes of the week

Posted Aug 8, 2015 13:50 UTC (Sat) by jospoortvliet (guest, #33164) [Link]

The strain on resources just isn't that big...

Security quotes of the week

Posted Aug 8, 2015 15:19 UTC (Sat) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

There has been several attempts. It turns out torrents are not as efficient for small files. Community distros use volunteer mirrors anyway.

Security quotes of the week

Posted Aug 13, 2015 9:12 UTC (Thu) by leni536 (guest, #103643) [Link]

Maybe IPFS will solve this.