Secure Coding mailing list archives
Re: informIT: Building versus Breaking
From: "Sergio 'shadown' Alvarez" <shadown () gmail com>
Date: Thu, 1 Sep 2011 09:26:54 +0200
"Blackhat IS about breaking stuff, the vendors area offers defense products and services to improve your security. For building stuff (as in development) there are other conferences out there. People go to Blackhat to be aware of what things might go wrong in order to protect better themselves." I really take offense to your comment.
There's no offense within the truth. btw, I forgot trainings in that paragraph.
I am seeing malware out in the field that is based on work by so-called noble "security researchers".
You are seeing?, woow, how? From this mail its clear you have no idea, and even less about the reverse engineering that is required to do such analysis. I am a reverse engineer, and I know what I'm talking about, but this is not the list to get into discussion about malware and reversing.
My litmus test is: If there were no whitehats and security researchers, would we be better off at fighting the bad guys? My answer is emphatically "yes".
Might I ask you a question? Why are you even in this mailinglist if you are the kind of guy or developer that just don't care about doing your products correctly? Based on your answer a whitehat for you is a nightmare, the one who is giving your boss the red pill and because of that you are 'force' to rewrite your code and do things as you should have done from the very beginning. People that follow your line of thinking are the ones who need to be replaced by people willing to learn in order to do better and more secure products.
I agree with Gary and from knowing Gary from all of his posts and podcasts, this is not a new stance from him. I am in complete agreement with him and always have been.
I do agree with Gary in that there is a need of having a new Conference about Defense Technologies and Awareness *for Developers*, that bring top notch security professionals and researchers together. I highlight *for developers* because for people who know what they are doing there are a bunch of conferences, and since you brought the topic malware, here you have some specifically for that topic: http://www.virusbtn.com/news/calendar/index Specially the VB Conference is really good. (Virus Bulletin)
And while I am here, the "Builders vs. Breakers" term should be attributed to Mark Curphey. You can probably still find his original post.
I'm sort of sick of the whole attribution thingy. I've seen many of that in academia 'research', where they just take research from some unknown researcher and put a label to it and clame attribution afterwards. The "Builders vs Breakers" meme has been discuss since *years*, I mean since before the 90s, and specially in other disciplines than software development. But since you've mentioned a specific person, a resent discussion which predates the author you've mentioned is here from June 3, 2008: http://marc.info/?l=cryptography&m=121260561401776&w=2 http://news.cnet.com/2300-1029_3-6240826.html?tag=ne.gall.pg Let me know if you find an article from the that Mark Curphey which predates that one and I'll give you another one older just to fit your needs.
The next question is: Can we ever prevent people from being "security researchers" or "white hats" or "black hats" or "bad guys"? No.
Can we prevent people from developing shitty code? Can we prevent people from talking BS? Neither.
But I think we have to start to take the lipstick off of the pigs and recognize what it is. It's called "Blackhat", isn't it?
A blackhat is the first one willing to keep things secret, so that nobody knows anything. Thanks to whitehats and researchers who present their work and bring some light to blind people is that products evolve during the time. Otherwise we would still have products like Windows 95 or Windows NT 4.0 which were joke from a security point of view. When Bill Gates sent the famous letter to all the company ask to stop doing what ever it was they were doing and start auditing and reviewing the security of their developments, a lot of developers and project managers quit because they didn't want to rebuild right what they've built wrong. I believe you think like those developers and PMs, that's not the way to go.
Very unfortunately, there is more glamour - and probably more reward - in breaking stuff.
That's a media/press problem, they are guilty for that. I personally have great respect for products well engineered.
What I hate is that "security researchers" and the "white hats" try to present themselves as noble and as the good guys.
I don't share that mindset, security researchers present a project and let the industry to come up with better solutions to the problem.
It's f*cking bullsh*t and a total scam. Ten years later for me and the state of infosec is much worse.
Compare Windows 2000 and Window 7, MacOS 9.x vs Lion, or Linux kernel 2.2 vs 2.6 (or 3.x) and then we talk OK?
There is also a nasty faction of infosec that will never want to solve problems which will put themselves out of work. Yep, I am throwing down that gauntlet FWIW.
There are also a lot of people accumulating dust under the carpet like nothing happens, hoping no one will uncover their hidden trash. Cheers, Sergio
Stephen On Wed, Aug 31, 2011 at 1:01 PM, Sergio 'shadown' Alvarez <shadown () gmail com> wrote:Hi gem, I've read your article to see what direction you were willing to take, before jumping into the conversation. Your post was exactly what I thought you were heading to. I disagree with your thought for many reasons. But first I would like to use proper terms so that we don't misuse some vocabulary: You said: """Software security should be a balanced approach of offense and defense (white hat and black hat, if you will)""" Whitehat: reports what he/she has found. Network vulenerabilities, software security flaws, flawed crypto, design flaws, or whatever it is that the individual found it was broken or wrong. Blackhat: doesn't report what he/she found, because she/he want to keep it that way. Of course there are a lot of grays out there too. Defense is…well... defense. To design and build proper software and hardware there are a lot of conferences out there, as well as trainings and a huge amount of literature. There are very good books when it comes to secure software development. Every year what is presented, in the best security conferences, are new techniques that developers need to be aware of in order to build secure products. Most of the presentations talk about things that were wrongly designed and/or corner-cases which were not considered. There are also a lot of tools and libraries which help development teams to do things right, specially libraries and templates like Microsoft Safeint as well as the safe APIs, which prevent developers from shooting themselves. They just need to use them. There are also managed languages, APIs to handle SQL securely, etc. It is just that a lot of developers don't use what is available to them. Blackhat is great as it is now, there are talks about new defense technologies from time to time too. Having more talks about defense would be use, in my opinion, to sale products than anything else. I don't believe it would do any good to Blackhat. """I am not opposed to breaking stuff (see "Exploiting Software" from 2004), but I am worried about an overemphasis on breaking stuff.""" Blackhat IS about breaking stuff, the vendors area offers defense products and services to improve your security. For building stuff (as in development) there are other conferences out there. People go to Blackhat to be aware of what things might go wrong in order to protect better themselves. And even then many good talks overlap unfortunately. Regards, Sergio On Aug 31, 2011, at 4:16 PM, Gary McGraw wrote:hi sc-l, I went to Blackhat for the first time ever this year (even though I am basically allergic to Las Vegas), and it got me started thinking about building things properly versus breaking things in our field. Blackhat was mostly about breaking stuff of course. I am not opposed to breaking stuff (see "Exploiting Software" from 2004), but I am worried about an overemphasis on breaking stuff. After a quick and dirty blog entry on the subject <http://www.cigital.com/justiceleague/2011/08/09/building-versus-breaking-a-white-hat-goes-to-blackhat/>, I sat down and wrote a better article about it: Software [In]security: Balancing All the Breaking with some Building http://www.informit.com/articles/article.aspx?p=1750195 I've also had a chat with Adam Shostack (a member of the newly formed Blackhat Advisors) about the possibility of adding some building content to Blackhat. Go Adam! Do you agree that Blackhat could do with some building content?? gem company www.cigital.com podcast www.cigital.com/silverbullet blog www.cigital.com/justoceleague book www.swsec.com _______________________________________________ Secure Coding mailing list (SC-L) SC-L () securecoding org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. Follow KRvW Associates on Twitter at: http://twitter.com/KRvW_Associates ______________________________________________________________________________________________ Secure Coding mailing list (SC-L) SC-L () securecoding org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. Follow KRvW Associates on Twitter at: http://twitter.com/KRvW_Associates _______________________________________________-- http://www.linkedin.com/in/stephencraigevans
_______________________________________________ Secure Coding mailing list (SC-L) SC-L () securecoding org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. Follow KRvW Associates on Twitter at: http://twitter.com/KRvW_Associates _______________________________________________
Current thread:
- Re: informIT: Building versus Breaking, (continued)
- Re: informIT: Building versus Breaking Steven M. Christey (Sep 01)
- Re: informIT: Building versus Breaking Goertzel, Karen [USA] (Sep 01)
- Re: informIT: Building versus Breaking James Walden (Sep 05)
- Re: informIT: Building versus Breaking Jeffrey Walton (Sep 05)
- Re: informIT: Building versus Breaking Jeremy Epstein (Sep 05)
- Re: informIT: Building versus Breaking Steven M. Christey (Sep 01)
- Re: informIT: Building versus Breaking Chris Schmidt (Sep 01)
- Re: informIT: Building versus Breaking Sergio 'shadown' Alvarez (Sep 01)
- "Building" conferences (was: informIT: Building versus Breaking) Martin Gilje Jaatun (Sep 05)
- Re: "Building" conferences (was: informIT: Building versus Breaking) Gary McGraw (Sep 05)
- Re: informIT: Building versus Breaking Sergio 'shadown' Alvarez (Sep 01)
- Re: informIT: Building versus Breaking Tom Brennan (Sep 05)
- Re: informIT: Building versus Breaking Goertzel, Karen [USA] (Sep 05)
- Re: informIT: Building versus Breaking Chris Schmidt (Sep 05)
- Re: informIT: Building versus Breaking Kevin W. Wall (Sep 05)
- Re: informIT: Building versus Breaking Chris Schmidt (Sep 05)