Chapter 31, Department of Computer Security? It's a joke. January 20th, 2006.
If you want to make a geek laugh derisively, suggest that responsibility for computer security be turned over to the government.
This reaction is guaranteed, regardless of ideology. Everyone knows that this is not possible, but rarely are the implications for political economy noted.
Now, keep in mind that geeks know that producing fabulous looking and acting things for the
web is only part of the job.
These are people who spend fantastic amounts of time dealing with security issues which
change every season, day, hour and even minute.
People know about viruses.
Spyware and adware meanwhile are incredible threats to people's home computers.
A new computer can be slowed to a crawl in a few days of quick browsing without good
security against hijackings, and a huge industry has sprung up promising solutions, some good
and some almost as dangerous as the thing they allegedly stop.
Some of these are free, and some quite expensive, and the typical geek must work to discover
what's what.
Other threats are less well known, such as the possibility that your own computer can
can be hijacked and controlled by other people who want to use it to store files or scan
for other hijackable ports.
This is mainly a threat faced by servers running large websites, huge magnets for hijackings
and hacks, but it even affects home computers.
For example, I was recently talking to a technical administrator of a prestigious host of thousands
of servers.
He was amazed by the number of root-level compromises that have been taking place in
recent months.
The possible holes in people's systems are without limit.
Software must be constantly upgraded.
Even one small mistake can lead to data loss and disaster.
He tried a little experiment.
He installed a new operating system on a new laptop and disabled the firewall.
He then hooked it up to a non-secure wireless network in an urban area.
The first attack came within 6 minutes.
In 12 minutes, the computer had already been hacked and was under the control of somebody
or something else.
All data on the computer was rendered vulnerable, available for looting or selling.
In a few minutes more, it would have become a workstation for more port scanning, denial
and been added to the empire of servers being controlled by some of the world's smartest criminal minds.
Not that a good firewall and secure connection are infallible solutions.
There is always a way in for someone with high-level skills and the will to take the risk.
To keep threats away involves the technical equivalent of street fights between hackers and security professionals.
The Fighters have similar skills. It's just that one group wears the black hats, and one wears white hats.
Some are criminals, some are saviors. The battle never stops, and yes, some of them change hats depending on their career prospects.
The fight involves deploying skills that are far beyond what most any normal person could conceive of possessing.
processing.
They can run circles around most computer science professors and even run-of-the-mill
webmasters.
Some will rant and rave against the security holes in proprietary products such as those
offered by Microsoft, and users of Internet Explorer would be likely to agree.
The thing hasn't been properly updated in many years.
It has not kept pace with the times and so attracts web-based evil like a landfill attracts
Other products, however, are different. Server-level software is constantly monitored for holes, with updates sent out automatically and often, though not always as often as people might like.
Still, open source advocates say that this proprietary stuff is expensive and dangerous.
The companies don't respond soon enough to threats, and no one but company employees can view the underlying code.
That means that improvements come more slowly.
With open source, the world community of programmers have access and work constantly to improve the product.
To be sure, hackers too have access to the same code, so here too you have a battle between good and evil.
Among the good guys, there is a debate.
is a debate. Should software holes be announced publicly, full disclosure, in the hope that
the firm that works on open source will fix it before the hackers find out? But between
the announcement and the fix, there is a gap that hackers can exploit. Perhaps, then, the
hole should only be revealed to the firm or individuals who manage the open source product,
limited disclosure. The downside here is that the people responsible will lack the frantic
Geeks thrive in emergencies, while non-emergencies fail to inspire.
So the debate over security rages furiously.
Open source or proprietary code, public security announcements or quiet revelations, development
or risk.
At any one time, all solutions are being used, with bulletin boards filling up thousands
and thousands of pages of debate based on experience. Ideology can play a part here,
but in the end, it comes down to what works best. And all the while, the war continues,
pushed onward by the relentless pace of development and progress toward better living standards.
We haven't even touched on the war between the virus makers and the virus killers. The
Competition here is also intense.
When a new virus is unleashed, the first firm to produce the fix wins the new level of consumer
devotion and attention.
A nothing company can become the next big thing by producing a fix for two or three
viruses in a row and doing it before the established firms get there.
An established firm can lose its market edge in a month by failing to update its virus
definitions in time.
The difference between winners and losers in this struggle comes down to minutes, not
days or weeks.
In this never-ending struggle, there are always trade-offs between the pace of development
and its security risks.
No software is perfect.
They all have bugs.
But people demand development.
The market never rests.
We must all take some risk.
How much is acceptable?
Competition prevails here, too.
A bad choice in favor of security over development can leave a company eating other companies'
dust.
A bad choice in favor of development over security can lead to bankruptcy in the face
of high-stakes security compromise.
Geek personalities reflect this trade-off.
Some develop on live servers and deploy every beta the hour it appears, while others test
and test and prefer only the tried and true.
All these fascinating details aside, keep in mind that the terrain on which these wars
rage is wholly market-based. The idea that any public bureaucracy could oversee the process
is unthinkable. So, let us ask the question again, so that the reader may join in the
derisive laughter. In a world populated by black hats, should the government be the sole
People wear the white hat?
Actually, is there any point at all in giving a white hat to the state?
It has no incentive to join the struggle.
It lacks the calculational means to assess the trade-off between security and development.
It lacks the entrepreneurial drive to produce either.
The nature of the bureaucratic organization is to stay put, protect itself and only move
As for the power to do good, how can anyone guarantee that it won't quickly become the power to do evil?
If experience is our guide, the government in a position of authority is more likely to be creating viruses and spyware rather than stopping them.
As for the impact of the law, I vaguely seem to recall some legislation passed a few years ago that made spam illegal.
Government can't produce software that can outsmart every hacker, not now, not ever.
But the government can violate liberty and waste vast resources in the attempt.
As important as computers have become, there are interesting implications here.
On a day-by-day basis, the security of these machines is a far bigger matter than the threat
of terrorism.
Whether we like it or not, and regardless of ideology, we all depend on market competition
to bring us not only innovation but also to protect us in our dealings with information
technology. It is not a perfect solution, it can be messy and fallible, but the market
is the strongest and best hope for security, and the alternative is unthinkable. How interesting
that we have been told for, oh, some 400 years that government is the agency we need to give
us the security that markets cannot give us.
There are a thousand rationales why intellectuals have believed this, but none of them seem
Everything very robust by comparison to the experience of our times.