While we're at it, let's just abandon all insecure network protocols. For every insecure protocol, there is an encrypted version, so why even keep the insecure protocols around? Why even install telnet when there's SSH? Why use FTP instead of SFTP? And what about instant messengers, plus IRC, NNTP, SNMP, and all the other unencrypted protocols? Boycott them all. Sure, you might say that we need to support these protocols for backwards compatibility. While that makes sense for now, we need to set some future date when we will phase these out, otherwise they will never leave us. Who wants to be backwards compatible with insecurity anyway?
While I'm on the subject of encryption, I say it's time everyone stopped coding their own homegrown encryption algorithms and just use well-accepted encryption standards. If you think that your custom triple-rot13-xor-encoded encryption function is unbreakable, think again. Why even bother with your own encryption when there is plenty of freely available code already out there? Why are programmers so compelled to reinvent the wheel? Obviously the public humiliation of endless security advisories isn't enough of a deterrent from people using ROT-13, XOR, or some other lame encryption. What do we have to do, pass a law or something? ...
How about responsible programming? Sure we have heard a lot about stack overflows and SQL injection, but if you write software, you should let people have a few security options rather than you making all the decisions for them. For example, give people the option to simply not record recently-opened documents, store personal information, or completely shut off unused services such as an embedded web server. When you configure the installer, it would help if you could also set the file permissions automatically so that others don't have to go back later to research and test for the most secure permissions.
Programmers, system administrators, what do you think?
No comments:
Post a Comment