andy vt's blog : Random

Security is a hassle. That's the point.

babgvant — Thu, 11 Apr 2013 12:27:00 GMT

We don't put locks on our doors because it's convenient. We do it to create inconvenience when someone wants to open them, hoping the bad guys respect that - moving on to an easier target. We use other methods like alarms, cameras, etc. to encourage the selection of other, easier, targets. None of these things is a guarantee against a determined adversary and the right tools. Using these techniques is not costless to us. It's a pain to have to carry a key, remember to carry a key, enter key codes or set the alarm. Of course we do these things because the hassle it creates for us, also affects those who would otherwise prey on our stuff. It generally works because the hassle is disproportionate.

The same thing is true about electronic doors. We use passwords and usernames to lock down accounts on the Interwebs. Making the same exchange in hassle (i.e. remembering passwords & usernames on myriad sites) there, as we do in the physical realm, hoping to realize the same disproportionate trade-off - two factor authentication doesn't change the fundamentals it just ratchets up the inconvenience realized by us and the bad guys.

Adding to this, we have to trust that the companies that host "our" data are investing the appropriate amount of care in building locks and safes. Are they using SSL, hashing our passwords, or building social-engineering resistant recovery mechanisms? These things aren't free, they cost money (a lot of money) and time to buy, build, and implement properly - everywhere.

At its core security is just about creating inconvenience, hopefully uneconomically viable amounts of inconvenience, and that's a hassle. For everyone. If only it was this easy:

Quiet Around Here

babgvant — Wed, 06 Jul 2011 13:50:00 GMT

It's been a long time since I've posted anything that wasn't an update to some utility up here; mostly because I've been able to get my random out on Twitter, but also because just haven't made the time. Twitter's a limiting medium, so it's not suitable all of the time. I've been meaning to write up some things, but haven't found the will to really organize my thoughts into something coherent so I must offer fair warning :)

Moving to Florida: change is hard (doesn't mean it's not good). There's a lot to like about Chicago (food, culture, diversity, convenience, urban-ness) and it will be fun living somewhere else (for a while at least) but it's going to be very different. A couple years back I finally got my house into the perfect HT state (surround sound, cat 6, OTA antenna), so moving to a different place where all that needs to be redone will suck. Probably going to rent for a while too, so there will be many compromises. Clearly a "white whine", but it's going to annoy me until I can get it all perfect again. That said, we're going because we want to; hobbies shouldn't hold you back.
SageTV: uncertainty sucks. I want to believe that good things will come from Google's acquisition, and I'm sure they will for the general population; but I don't see it benefiting me or other enthusiasts. The lack of Google sized profits in our niche isn't encouraging, there are fringe scenarios where the products continues to evolved in a palatable direction but there's only so long that I can ignore my inner statistician.
Copy-Once: Cox needs to get with the program. Having used a four tuner DCT for a few months now, it's going to HURT going back to a single HDPVR if the cable co where we're going doesn't use Copy-Freely (most likely Cox Cable, which doesn't).

Know a Developer Who Needs a Job?

babgvant — Sun, 14 Nov 2010 20:51:00 GMT

A friend of mine (also in Chicago) is looking for software developers with 2-4 years of experience. Candidates must live in Chicagoland and be able to legally work in the US, if you fit the bill or know someone who does send me a resume.