June 2009
Beginner
260 pages
5h 40m
English
Content preview from The Myths of SecurityBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 30. “Responsible Disclosure” Isn’t Responsible
I was pretty amused recently when two people I respect went at each other over vulnerability disclosure, quickly devolving into name-calling. It’s always fun to watch a flame war (nobody got compared to Hitler, but one person did get compared to senile old Grandpa Simpson, walking around with his pants down).
But, to some degree, the two guys seemed to be talking past each other. One was arguing that full disclosure (meaning that vulnerabilities in other people’s software will be made public eventually, no matter what) puts end users at risk, and the other was arguing that finding and fixing bugs is an important part of keeping code secure.
I happen to agree with both of them. Yes, if we didn’t have good guys finding and fixing problems in code, there would be all the more problems for bad guys to find and leverage in their quest to take over the world. This is particularly the case because many development organizations don’t invest in fixing problems, since there aren’t good incentives (plus, there isn’t much of a talent pool for this kind of work).
But, most of the problems in software that bad guys leverage are problems that the good guys have found and publicized.
If we hold to these two arguments, it seems that we can either live in a world where we hide our security problems but are at risk from bad guys easily finding lots of them, or we can live in a world where the good guys hand the bad guys a roadmap for how to be bad ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.