trotsky

I assume this has to be about inventory - some kind of line of credit that allows them to offer customer financing, shift away from their pre-order system, or some kind of upfront cost associated with a process upgrade.

It's hard to believe there is much money to be spent on R&D for asic hashing, or that they would gain much via some big marketing campaign.

An amusingly worded statement perfectly delivered in intelligence speak. Because Mr. Hayden is so crucially aware of how improbable it is for anyone to keep anything secret at all anymore, he's only worried about people's misplaced confidence in secrecy being rationalized. The IC banks on people's impression that secrecy is still practical, but certainly once you realize that if the people most aware of the porous nature of data networks can't even stop their secure side documents from leaking en masse nobody less focused will consider their documents private.

It's a classic double edged sword - the intelligence community had been the primary driver of innovation in computer and network defense strategies. But somewhere between the beginning and the end of the development of TPM they decided that insecure computers were so valuable as an asset that it couldn't be risked that they might fund research that might accidentally result in some real level of defense.

If general Alexander spent a tenth the money on defense as he does on offensive teams and research and bugs maybe they'd actually have more advanced strategies than air gap and pray. But once the basic judgement was made that software quality issues appeared to make computer security np complete they basically gave up on the problem. Thus began the race to exploit and backdoor the world that we took an early lead in but has lead to a lot of blowback when not everyone was as concerned as we were with not sharing the benefits with private industry. Now the big states know more or less everything about each other, while US multinationals essentially have to horse trade for even basic information sharing about active intrusions on their networks. Meanwhile the only people left in the dark are members of the public that are trying to play by the rules.

Perhaps this is a response to growing use of certificate pinning? Facebook apparently has joined google in using pins, and I was recently told that microsoft is enabling pinning as an option in EMET4. But if that was the issue, that would tend to suggest they had been previously accustomed to rewriting some of these providers traffic with unlikely root ca's, something which people have been keeping an eye out for and to my knowledge has never been caught in the wild.

I agree that this kind of behavior is too obvious and not socially acceptable or common practice. But the concept of the modern style of silicon valley private equity industry (of which angels are obviously within the broad ecosystem) as that operates with any substantial amount of ethics or is deserving of or even expecting trust is so far from my experiences as to be laughable. They just are very loathe to be as obvious, or apply pressure without sufficient supporting influence.

If you've been sitting at the poker table for 30 minutes and you can't tell who the sucker is, it's you.

And while a bit toung in cheek, i'm not too aware of this whole ip address scarcity thing. I've got a decent chunk of a /29, if you could use a /48 or ten for your local networks just ask! Or would it be tough to squeeze down to only 18,446,744,073,709,551,616 local addresses?

The last time that such items were anything but an unusual novelty was something like 2003. The last time they were the most substantial threat was sometime in the 1990's. And while it typically wasn't viral, a variety of naive threats produced by amateurs continued to be a good portion of the threat landscape until around the middle of the last decade.

That isn't to say database driven signature systems never stop any attacks. They just provide such a small amount of defense and so consistently unable to identify well publicized threats months after their public use in the wild that there is little to any statistical difference in compromise between a well configured and patched system with an av engine and the same system without an av engine.

But while their product is ineffective, they are far from alone in the security industry. IDS systems are wildly ineffective in any configuration that isn't custom tuned for defending an extremely limited network that exclusively transports a few specific protocols in very predictable ways - mostly backend networks in datacenters. Typical edge firewalls defend against a threat primarily exists because they enable it - clients are so vulnerable on local networks that can't survive that way on open networks. But without them we'd have just reduced the attack surface like we;ve done with public facing servers. As nearly every compromise includes a service that's intentionally exposed or intentionally allowed through the edge, they at best are a limited crutch to avoid having to ensure each computer is as minimally exposed to start with. If your firewall allows you to be an extra soft target once an attacker has established a foothold inside it's arguable that you'd have been better off totally exposed so that you limit the number of additional systems that exist in radically insecure postures.

The only automated system that comes to mind that ive seen provide any real amount of value are the expensive and exclusive block list subscriptions that contain databases of actively operating C&C servers and similar active apt sources. But these would become worthless if any of them ever enjoyed widespread adoption, as they'd simply stop being lazy and using the same servers all the time.

ASLR, DEP and even managed code to a certain extent all are similarly ineffective in that while making exploits more complicated they've had no impact on the rate of compromise.

The simple fact is that offensive security has won for the forseeable future and defensive security has lost entirely, with no real hope of change without dramatic practice shifts.

For client security the only things that have provided clear and practical benefits have been a) reducing the attack surface by mass removal of services and features and b) building the system withe the expectation of regular compromise, and including an easy and reliable way to wipe and restore. Oh and forced automatic patching.

The ChromeOS team gets it. The windowsrt team gets it. ios gets it. Anyone producing a client OS that is feature rich, highly configurable strives for easy out of the box use should be considered systemically insecure at this point. Any motivator attacker will succeed against it 99%+ of the time.

But since there are really no other options for so many people and tasks, it's very uncomfortable to explain to someone that they are able to do little to nothing about it that won't involve draconian systems users would refuse to use, and that compromise is at some point essentially inevitable.

So you tell them to run anti-virus. It's like children hiding under their desks in the event of nuclear war. It helps avoid some amount of existential crisis.

That's why the anti-virus age won't be over for a long, long time. Because if you don't have a replacement that's actually good, and no one even has a clue what that would look like, you still need to tell people to use their AV. Just like you need to tell people there is heaven.