News: 1615363326

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

A Code War has replaced The Cold War. And right now we’re losing it

(2021/03/10)


Column Remember the Cold War? For me, growing up in America meant living under the permanent, intangible threat of sudden vaporisation by thermonuclear attack. It added a piquant pointlessness to everything. Ashes, ashes, all burn down.

Yet the world stubbornly refused to end. Communism collapsed, Western neoliberal democracy seemed triumphant.

[1]

Then just as we entered a phase of peace and prosperity, the internet came along and ruined everything.

It took some time; Rome was not destroyed in a day. And we should have seen it coming. A full year before the Berlin Wall came down, the [2]Morris Internet Worm took the then-tiny internet down with an exploit drawn from weaknesses in sendmail, finger and remote shell. In 1989, Robert Tappan Morris was [3]arrested and prosecuted under the then brand-new [4]Computer Fraud and Abuse Act .

[5]

I’m increasingly of the belief that instead we should have given him the Presidential Medal of Freedom.

Morris showed us the weaknesses of connected systems, demonstrating in code that every connection represents an attack surface. At a moment time when those connections began multiplying exponentially - from hardly any to almost everything - we could have heeded the message instead of shooting the messenger.

How do we combat mass global misinformation? How about making the internet a little harder to use [6]READ MORE

Flash forward thirty-two years and we can see that the landscape we inhabit today could have been predicted. And that means it could have been avoided.

Instead, we see [7]the SolarWinds hack , described as a “digital Pearl Harbor”, so extensive is its scope. And the hits keep on coming, from [8]odd malware worming its way into tens of thousands of macOS systems , to [9]motherboards that allegedly record and transmit data back to servers in China, and even [10]corrupted dependencies in the software stacks used by - well, pretty much everyone, everywhere.

Connections can be powerful, but with great power... you know the rest.

So who’s responsible? We try to blame users, or lazy manufacturers, or obscure procedures or “bad actors” (which, depending on the paranoia of the day, can range from Russia to cryptocurrency-fueled ransomware dealers.) There’s always someone to blame, shifting responsibility for the failure carefully away from anyone who otherwise might be forced to change what they’re doing.

If this goes on, the scope for networked collaboration will continue to dwindle, until it disappears completely behind walls of denial and compromised infrastructure. This problem is not moving toward a solution. It’s not even in some sort of status quo. It’s getting worse. Rapidly.

It’s long past time we faced that ugly truth. And took responsibility.

That means putting an abrupt pause to software and hardware systems development as they’ve been practiced for the past 30 years. Throwing out the practices that landed us here and acknowledging the real message of the Morris Internet Worm: the Cold War ended, but the Code Wars began.

That time when an NSA bloke's son borked the ENTIRE INTERNET... [11]READ MORE

Like the Cold War, the Code Wars won’t have much of a body count and might never flare into outright violence. But when we peel back the cool surfaces, we witness the same titanic battles for power and control, this time using cyberspace as a platform for dominance - just as, militarised by ICBMs, outer space became the premier platform for dominance in the Cold War.

Space may also point the way toward a solution. Reagan’s largely fanciful "Star Wars" program accelerated the Soviet Union’s slide into economic and military collapse. It may be possible that a similar approach - using "moonshot" technologies like [12]artificial general intelligence and [13]high qubit quantum computing - could place the defenders so far ahead of the attackers that assault becomes effectively impossible, or makes continuing combat ruinously expensive. Although far from guaranteed, we could put an end to the Code Wars by changing the game.

[14]

Is that sort of doubling down on computing exactly the wrong approach? Whatever we do, we can’t keep doing what we’re doing. Denial has stopped working. Either we lose the game – or we change it. ®

Get our [15]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YEim01O6VWBJRXGr4PybsQAAAMo&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://www.theregister.com/2013/11/04/morris_worm_anniversary/

[3] https://www.youtube.com/watch?v=G2i_6j55bS0&t=5s

[4] https://www.nacdl.org/Landing/ComputerFraudandAbuseAct

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YEim01O6VWBJRXGr4PybsQAAAMo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2021/02/08/make_the_internet_harder_to_use/

[7] https://www.theregister.com/2020/12/15/solar_winds_update/

[8] https://www.theregister.com/2021/02/22/silver_sparrow_malware_for_apple_m1_silicon/

[9] https://www.theregister.com/2021/02/12/supermicro_bloomberg_spying/

[10] https://www.theregister.com/2021/02/10/library_dependencies_attack/

[11] https://www.theregister.com/2013/11/04/morris_worm_anniversary/

[12] https://www.theregister.com/2019/07/22/microsoft_chucks_money_at_openai_to_develop_artificial_general_intelligence/

[13] https://www.theregister.com/2020/04/16/quantum_computing_cost_stability_paper/

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/columnists&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YEim01O6VWBJRXGr4PybsQAAAMo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[15] https://whitepapers.theregister.com/

Sometimes it is best to lose graciously ... in order to save oneself from totally unnecessary pain

amanfromMars 1

Space may also point the way toward a solution with slides into an economic and military superiority. It may be possible that a similar approach - using "moonshot" technologies like artificial general intelligence and high qubit quantum computing - could place attackers so far ahead of defenders that defence and opposition and competition becomes effectively impossible and ruinously expensive and quite certain to guarantee a changeover into what would definitely be Greater IntelAIgent Gamesplay.

What's not to like?

The Code War?!?

KittenHuffer

I remember the [1]Cod war !!!

South of the Equator the winner was ----------------->

[1] https://en.wikipedia.org/wiki/Cod_Wars

Yet another uncomfortable truth

Mike 137

Unfortunately, the harsh reality is that software development is the only branch of engineering that doesn't have established standards and methods that are proven to yield trustworthy results. It took a couple of hundred years for such standards and methods to be worked out in civil, mechanical and electrical engineering, and it may just be that software development hasn't been around for long enough yet. But the big difference is the extent of deployment of the technologies while they are still immature. Software now permeates almost everything, but we aren't yet able to assure its adequacy. That's the real problem we face, and it can only be solved by establishing standards and mandating their application.

In no other branch of engineering can a totally self-trained practitioner be taken on trust and tasked with delivering mission critical (or indeed life critical) systems. It's about time we stopped this practice in software development for those domains. So we need enforced standards that deliver safe systems, as we have for even for technicianship disciplines such as electrical installation and gas fitting. Nobody would argue for mandatory certification of games developers, but I would most certainly insist on it for those developing things that can affect livelihoods and lives, and such certification should ensure understanding of first principles, not just knowledge of the knobs and levers of proprietary tools. What we have had to date instead is a worrying trend of successive generations of tools that make it easier to deliver results without paying attention to the essential first principles - a deskilling that perpetuates the very problem we should be trying to solve.

.

Re: Yet another uncomfortable truth

Paul Crawford

It is far worse than just the lack of "sound principles" being used, these days software comes with license agreements that abdicate responsibility of the consequences of crap code.

What other discipline would get away with that?

Add to that a lot of connectivity and inter-dependence being added is driven my marketing droids (or worse, advertising brokers) and the future looks bleak indeed.

CrackedNoggin

Is it possible that companies that take security seriously will survive while the rest perish? Of course, there is also "bad luck".

It's a double bluff?

David Glasgow

Cunning plan, in a nutshell:

We're in, and we've got what we need

Ok. In a stupid way, say we're going to do something stupidly

Job for a Politician?

Yup

Should we actually do something stupid?

It's always an option.

Misdirection?

Yup. And they'll carry on thinking we're idiots.

Bonus!

high qubit quantum computing and artifical general intelligence

Pascal Monett

If we wait on those to solve our connectivity problems, we might as well unplug everything.

I don't know what the final solution is, but a good start is to stop using other people's code with blind trust. Oh sure, take a module from GitHub, by all means, but don't link to it. Bring it in on your dev server, check the code, test it to see if it works. If it is suitable, then port that to your production environment.

If there's an update on GitHub, start over.

Yes, it is tedious and time-consuming. The alternative is SolarWinds123.

Your choice.

TVC

I'm currently reading This is How They Tell Me the World Ends by Nicole Petlroth. I worked in I T for 40 years and some of that involved me in cyber security but this book is a real eye opener and a thrilling read to boot.

Do not write below this line.