WEBVTT NOTE 31. Department of Computer Security? It’s a Joke 1 00:00:00.000 --> 00:00:09.000 Chapter 31, Department of Computer Security? It's a joke. January 20th, 2006. 2 00:00:09.000 --> 00:00:17.000 If you want to make a geek laugh derisively, suggest that responsibility for computer security be turned over to the government. 3 00:00:17.000 --> 00:00:28.000 This reaction is guaranteed, regardless of ideology. Everyone knows that this is not possible, but rarely are the implications for political economy noted. 4 00:00:28.000 --> 00:00:34.260 Now, keep in mind that geeks know that producing fabulous looking and acting things for the 5 00:00:34.260 --> 00:00:36.740 web is only part of the job. 6 00:00:36.740 --> 00:00:41.680 These are people who spend fantastic amounts of time dealing with security issues which 7 00:00:41.680 --> 00:00:47.200 change every season, day, hour and even minute. 8 00:00:47.200 --> 00:00:48.920 People know about viruses. 9 00:00:48.920 --> 00:00:54.520 Spyware and adware meanwhile are incredible threats to people's home computers. 10 00:00:54.520 --> 00:00:59.160 A new computer can be slowed to a crawl in a few days of quick browsing without good 11 00:00:59.160 --> 00:01:06.200 security against hijackings, and a huge industry has sprung up promising solutions, some good 12 00:01:06.200 --> 00:01:11.240 and some almost as dangerous as the thing they allegedly stop. 13 00:01:11.240 --> 00:01:16.640 Some of these are free, and some quite expensive, and the typical geek must work to discover 14 00:01:16.640 --> 00:01:18.600 what's what. 15 00:01:18.600 --> 00:01:23.080 Other threats are less well known, such as the possibility that your own computer can 16 00:01:23.080 --> 00:01:28.000 can be hijacked and controlled by other people who want to use it to store files or scan 17 00:01:28.000 --> 00:01:30.800 for other hijackable ports. 18 00:01:30.800 --> 00:01:36.480 This is mainly a threat faced by servers running large websites, huge magnets for hijackings 19 00:01:36.480 --> 00:01:40.900 and hacks, but it even affects home computers. 20 00:01:40.900 --> 00:01:47.200 For example, I was recently talking to a technical administrator of a prestigious host of thousands 21 00:01:47.200 --> 00:01:48.700 of servers. 22 00:01:48.700 --> 00:01:53.400 He was amazed by the number of root-level compromises that have been taking place in 23 00:01:53.400 --> 00:01:54.900 recent months. 24 00:01:54.900 --> 00:01:59.820 The possible holes in people's systems are without limit. 25 00:01:59.820 --> 00:02:02.500 Software must be constantly upgraded. 26 00:02:02.500 --> 00:02:07.340 Even one small mistake can lead to data loss and disaster. 27 00:02:07.340 --> 00:02:09.480 He tried a little experiment. 28 00:02:09.480 --> 00:02:14.340 He installed a new operating system on a new laptop and disabled the firewall. 29 00:02:14.340 --> 00:02:18.980 He then hooked it up to a non-secure wireless network in an urban area. 30 00:02:18.980 --> 00:02:21.720 The first attack came within 6 minutes. 31 00:02:21.720 --> 00:02:26.380 In 12 minutes, the computer had already been hacked and was under the control of somebody 32 00:02:26.380 --> 00:02:28.700 or something else. 33 00:02:28.700 --> 00:02:34.300 All data on the computer was rendered vulnerable, available for looting or selling. 34 00:02:34.300 --> 00:02:39.660 In a few minutes more, it would have become a workstation for more port scanning, denial 35 00:02:39.660 --> 00:02:49.660 and been added to the empire of servers being controlled by some of the world's smartest criminal minds. 36 00:02:49.660 --> 00:02:54.660 Not that a good firewall and secure connection are infallible solutions. 37 00:02:54.660 --> 00:03:00.660 There is always a way in for someone with high-level skills and the will to take the risk. 38 00:03:00.660 --> 00:03:07.660 To keep threats away involves the technical equivalent of street fights between hackers and security professionals. 39 00:03:07.660 --> 00:03:15.660 The Fighters have similar skills. It's just that one group wears the black hats, and one wears white hats. 40 00:03:15.660 --> 00:03:25.660 Some are criminals, some are saviors. The battle never stops, and yes, some of them change hats depending on their career prospects. 41 00:03:25.660 --> 00:03:32.660 The fight involves deploying skills that are far beyond what most any normal person could conceive of possessing. 42 00:03:32.660 --> 00:03:33.660 processing. 43 00:03:33.660 --> 00:03:38.020 They can run circles around most computer science professors and even run-of-the-mill 44 00:03:38.020 --> 00:03:40.580 webmasters. 45 00:03:40.580 --> 00:03:45.660 Some will rant and rave against the security holes in proprietary products such as those 46 00:03:45.660 --> 00:03:51.460 offered by Microsoft, and users of Internet Explorer would be likely to agree. 47 00:03:51.460 --> 00:03:55.540 The thing hasn't been properly updated in many years. 48 00:03:55.540 --> 00:04:00.900 It has not kept pace with the times and so attracts web-based evil like a landfill attracts 49 00:04:00.900 --> 00:04:15.900 Other products, however, are different. Server-level software is constantly monitored for holes, with updates sent out automatically and often, though not always as often as people might like. 50 00:04:15.900 --> 00:04:21.900 Still, open source advocates say that this proprietary stuff is expensive and dangerous. 51 00:04:21.900 --> 00:04:28.900 The companies don't respond soon enough to threats, and no one but company employees can view the underlying code. 52 00:04:28.900 --> 00:04:31.900 That means that improvements come more slowly. 53 00:04:31.900 --> 00:04:38.900 With open source, the world community of programmers have access and work constantly to improve the product. 54 00:04:38.900 --> 00:04:45.900 To be sure, hackers too have access to the same code, so here too you have a battle between good and evil. 55 00:04:45.900 --> 00:04:48.900 Among the good guys, there is a debate. 56 00:04:48.900 --> 00:04:55.620 is a debate. Should software holes be announced publicly, full disclosure, in the hope that 57 00:04:55.620 --> 00:05:00.940 the firm that works on open source will fix it before the hackers find out? But between 58 00:05:00.940 --> 00:05:07.100 the announcement and the fix, there is a gap that hackers can exploit. Perhaps, then, the 59 00:05:07.100 --> 00:05:12.260 hole should only be revealed to the firm or individuals who manage the open source product, 60 00:05:12.260 --> 00:05:17.640 limited disclosure. The downside here is that the people responsible will lack the frantic 61 00:05:17.640 --> 00:05:27.440 Geeks thrive in emergencies, while non-emergencies fail to inspire. 62 00:05:27.440 --> 00:05:31.600 So the debate over security rages furiously. 63 00:05:31.600 --> 00:05:38.080 Open source or proprietary code, public security announcements or quiet revelations, development 64 00:05:38.080 --> 00:05:39.080 or risk. 65 00:05:39.080 --> 00:05:45.560 At any one time, all solutions are being used, with bulletin boards filling up thousands 66 00:05:45.560 --> 00:05:51.880 and thousands of pages of debate based on experience. Ideology can play a part here, 67 00:05:51.880 --> 00:05:58.800 but in the end, it comes down to what works best. And all the while, the war continues, 68 00:05:58.800 --> 00:06:05.160 pushed onward by the relentless pace of development and progress toward better living standards. 69 00:06:05.160 --> 00:06:10.480 We haven't even touched on the war between the virus makers and the virus killers. The 70 00:06:10.480 --> 00:06:13.440 Competition here is also intense. 71 00:06:13.440 --> 00:06:19.160 When a new virus is unleashed, the first firm to produce the fix wins the new level of consumer 72 00:06:19.160 --> 00:06:21.400 devotion and attention. 73 00:06:21.400 --> 00:06:26.040 A nothing company can become the next big thing by producing a fix for two or three 74 00:06:26.040 --> 00:06:31.520 viruses in a row and doing it before the established firms get there. 75 00:06:31.520 --> 00:06:36.580 An established firm can lose its market edge in a month by failing to update its virus 76 00:06:36.580 --> 00:06:39.240 definitions in time. 77 00:06:39.240 --> 00:06:43.920 The difference between winners and losers in this struggle comes down to minutes, not 78 00:06:43.920 --> 00:06:46.400 days or weeks. 79 00:06:46.400 --> 00:06:51.620 In this never-ending struggle, there are always trade-offs between the pace of development 80 00:06:51.620 --> 00:06:53.800 and its security risks. 81 00:06:53.800 --> 00:06:55.820 No software is perfect. 82 00:06:55.820 --> 00:06:57.560 They all have bugs. 83 00:06:57.560 --> 00:06:59.460 But people demand development. 84 00:06:59.460 --> 00:07:01.320 The market never rests. 85 00:07:01.320 --> 00:07:03.640 We must all take some risk. 86 00:07:03.640 --> 00:07:06.440 How much is acceptable? 87 00:07:06.440 --> 00:07:08.840 Competition prevails here, too. 88 00:07:08.840 --> 00:07:14.160 A bad choice in favor of security over development can leave a company eating other companies' 89 00:07:14.160 --> 00:07:15.160 dust. 90 00:07:15.160 --> 00:07:20.080 A bad choice in favor of development over security can lead to bankruptcy in the face 91 00:07:20.080 --> 00:07:23.520 of high-stakes security compromise. 92 00:07:23.520 --> 00:07:26.880 Geek personalities reflect this trade-off. 93 00:07:26.880 --> 00:07:32.480 Some develop on live servers and deploy every beta the hour it appears, while others test 94 00:07:32.480 --> 00:07:37.000 and test and prefer only the tried and true. 95 00:07:37.000 --> 00:07:42.140 All these fascinating details aside, keep in mind that the terrain on which these wars 96 00:07:42.140 --> 00:07:48.640 rage is wholly market-based. The idea that any public bureaucracy could oversee the process 97 00:07:48.640 --> 00:07:54.980 is unthinkable. So, let us ask the question again, so that the reader may join in the 98 00:07:54.980 --> 00:08:01.160 derisive laughter. In a world populated by black hats, should the government be the sole 99 00:08:01.160 --> 00:08:03.320 People wear the white hat? 100 00:08:03.320 --> 00:08:09.060 Actually, is there any point at all in giving a white hat to the state? 101 00:08:09.060 --> 00:08:12.160 It has no incentive to join the struggle. 102 00:08:12.160 --> 00:08:18.280 It lacks the calculational means to assess the trade-off between security and development. 103 00:08:18.280 --> 00:08:22.280 It lacks the entrepreneurial drive to produce either. 104 00:08:22.280 --> 00:08:28.540 The nature of the bureaucratic organization is to stay put, protect itself and only move 105 00:08:28.540 --> 00:08:38.540 As for the power to do good, how can anyone guarantee that it won't quickly become the power to do evil? 106 00:08:38.540 --> 00:08:47.540 If experience is our guide, the government in a position of authority is more likely to be creating viruses and spyware rather than stopping them. 107 00:08:47.540 --> 00:08:56.540 As for the impact of the law, I vaguely seem to recall some legislation passed a few years ago that made spam illegal. 108 00:08:56.540 --> 00:09:03.780 Government can't produce software that can outsmart every hacker, not now, not ever. 109 00:09:03.780 --> 00:09:09.860 But the government can violate liberty and waste vast resources in the attempt. 110 00:09:09.860 --> 00:09:15.740 As important as computers have become, there are interesting implications here. 111 00:09:15.740 --> 00:09:20.780 On a day-by-day basis, the security of these machines is a far bigger matter than the threat 112 00:09:20.780 --> 00:09:22.780 of terrorism. 113 00:09:22.780 --> 00:09:28.460 Whether we like it or not, and regardless of ideology, we all depend on market competition 114 00:09:28.460 --> 00:09:33.860 to bring us not only innovation but also to protect us in our dealings with information 115 00:09:33.860 --> 00:09:40.580 technology. It is not a perfect solution, it can be messy and fallible, but the market 116 00:09:40.580 --> 00:09:48.580 is the strongest and best hope for security, and the alternative is unthinkable. How interesting 117 00:09:48.580 --> 00:09:54.940 that we have been told for, oh, some 400 years that government is the agency we need to give 118 00:09:54.940 --> 00:09:59.180 us the security that markets cannot give us. 119 00:09:59.180 --> 00:10:04.100 There are a thousand rationales why intellectuals have believed this, but none of them seem 120 00:10:04.100 --> 00:10:08.100 Everything very robust by comparison to the experience of our times.