Marcus Ranum

My point is that "open fire" is the wrong phrase. Medieval blacksmiths did not use an open fire. I follow a blacksmith who uses a propane-heated forge to make knives and other small items. Here is a picture of the new forge in his workshop: https://ranum.com/badger_forge/2023/05/19/the-new-forge/ Here is a picture of the old forge in use: https://ranum.com/badger_forge/2019/06/04/silver-in-the-forge/ . Using coal/charcoal would not make it more bad ass.

http://www.ranum.com/security/computer_security/editorials/dumb/ "The Six Dumbest Ideas in Computer Security" > #1) Default Permit > #2) Enumerating Badness

Two decades of experience suggests that "strengthening human security by training" ain't happening, no matter how hard/smart you try. The technical controls have to be beefed up to a point where that human-weak-link is eliminated. These tests are nothing but CISOs'(and Red Teams, and the whole industry around it) justifying their existence, and potentially doing a song-and-dance about it at the quarterly all-hands. Nothing more, nothing less. We can come back to this thread in another year/two years/five years/decade, and I can bet dollars-to-doughnuts, the industry will still be training humans, and claiming these pointless statistics about phishing. ;-) On this note, see #6 "Educating Users", in Marcus Ranum's excellent article "The Six Dumbest Ideas in Computer Security": https://www.ranum.com/security/computer_security/editorials/dumb/

The article and the linked NIST page were not specific about the BIOS flaw, but based on Google searches for "bios security flaw," it seems that even the worst ones (the CompuTrace Lojack flaw and Johanna Rutkowska's Intel flaw) require the attacker to have already compromised the operating system. If an attacker can compromise your computers' OSes, then disabling the hardware is probably the least of your worries. By default, the major PC operating systems follow Ideas 1-3 of the "Six Dumbest Ideas in Computer Security" ( http://www.ranum.com/security/computer_security/editorials/dumb/ ) in terms of executables. While you can reconfigure most common OSes not to follow these ideas, most home and business computers will follow the default configuration out of convenience.

Educating users is the #5 dumbest idea in computer security ;P http://www.ranum.com/security/computer_security/editorials/dumb/index.…

Agent sandboxing is an important problem. I want to deploy agentic AI to everyone at my enterprise and security is the big blocker. Credential scanning seems tractable. There’s a large body of work around scanning for credentials in repos to prevent leakage via GitHub. If speed really matters, you could minimize the patterns you check by integrating credential management. By definition, you know all the secrets you’re trying to protect. Look for _exactly_ those rather than regex which try to enumerate the general case. Still, solving credential leakage is necessary but not sufficient. There’s other sensitive information in your context: customer contact information, costs & pricing, snarky slack conversations. That stuff could show up anywhere online your agent can post. Like Google Reviews. The structural problem is that Enumerate Badness is always incomplete but it’s impossible to Enumerate Goodness for a generative system. The only solution I see is to allowlist resources at the network level and assume 100% cross contamination. This article helped shape my thinking on this topic: The Six Dumbest Ideas in Computer Security https://www.ranum.com/security/computer_security/editorials/dumb/

Anti-virus software is not necessary. It's a side effect of poor system configuration, slow release cycles for patched software and to a lesser extent, poorly designed software. If a severe vulnerability is discovered, open source communities race to distribute a new version of the software (faster than anti-virus vendors can respond). Package management allows patches for _all_ software to be rolled out quickly and securely. A turnaround time exceeding 2 hours from knowledge of a critical vulnerability to patched software being distributed to 1,000,000's of computers would be considered slow. The concept of executing files downloaded from Internet sites, provided on removable media or sent via email is completely foreign. Proprietary vendors tend to follow the processes defined in their ISO 9001 compliant Quality Management System. They wait for the next weekly "Urgent" Security Working Group Meeting so that a proposal to develop a Software Change Request can be agreed upon. ... blah blah... 2 months later you _may_ have updated software that users won't know about because they don't check the sites of the 100's of applications on their computers on a daily schedule. Microsoft _could_ do more, particularly with respect to system-wide package management. However, _proprietary software vendors_ are the primary culprits. Microsoft can't help Windows users if software vendors refuse to respond to security vulnerabilities quickly or fail to design their software with…

""" Examine a typical antivirus package and you'll see it knows about 75,000+ viruses that might infect your machine. Compare that to the legitimate 30 or so apps that I've installed on my machine, and you can see it's rather dumb to try to track 75,000 pieces of Badness when even a simpleton could track 30 pieces of Goodness. In fact, if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved the following problems: * Spyware * Viruses * Remote Control Trojans * Exploits that involve executing pre-installed code that you don't use regularly Thanks to all the marketing hype around disclosing and announcing vulnerabilities, there are (according to some industry analysts) between 200 and 700 new pieces of Badness hitting the Internet every month. Not only is "Enumerating Badness" a dumb idea, it's gotten dumber during the few minutes of your time you've bequeathed me by reading this article. """ - http://www.ranum.com/security/computer_security/editorials/dumb/

Of the “six famous bad ideas in computer security”, the first and second are “default permit” and “enumerating badness”. http://www.ranum.com/security/computer_security/editorials/dumb/

I actually deployed several "FireWall ToolKit" firewalls in the '90s for various organizations. I still maintain one on an internal QA network. It allows whitelists. https://www.fwtk.org/ https://avolio.com/fwtk-history/ https://www.ranum.com/security/computer_security/editorials/codetools/

Marcus J. Ranum's "Artificial Ignorance" concept is pretty good. I did an implementation and have been running it for more than 10 years: http://www.ranum.com/security/computer_security/papers/ai/ Someone's also done a Python implementation: https://github.com/lchamon/ai ...and it looks like there's one in syslog-ng Premium Edition: https://syslog-ng.com/documents/html/syslog-ng-pe-latest-guides/en/sys…

Counter point, #4) Hacking is cool http://www.ranum.com/security/computer_security/editorials/dumb/index.…

This is (probably) the link: http://www.ranum.com/security/computer_security/editorials/dumb/

I stumbled upon this (awesome) article that made me realize tons of things: http://www.ranum.com/security/computer_security/editorials/dumb/index.… I'm not a security expert (far from it) but I hope that I understand enough the importance of security to learn a bit about it and implement it as much as I can. Secure defaults is now maybe the first concept I'm trying to explain to people in my company.

You would probably be better off will an artificial-ignorance[0] kind of approach where you frequently measure what's running on your computer in order to establish a baseline, and after that compare against the baseline to look for outliers in terms of memory/cpu usage. You will also want to use other tools to look at network and filesystem usage. 0 - http://www.ranum.com/security/computer_security/papers/ai/

It's a another example of enumerating badness: http://www.ranum.com/security/computer_security/editorials/dumb/ which is prevented by only permitting traffic that is supposed to be on your network / going through your NIC.

It seems the author originally published this in 2005; reaching the bottom: "Morrisdale, PA Sept 1, 2005." On the linking page, http://www.ranum.com/security/computer_security/index.html, it states, "(originally written for certifiedsecuritypro.com)." Might the submitter have meant to make a point about the predictions made by the author, ten years ago? For example, "My prediction is that the "Hacking is Cool" dumb idea will be a dead idea in the next 10 years."

Right now, on one hand, we're spending billions of dollars for this Myth of Homeland Security in the hopes of protecting against terrorists, rogue states, and ideological nutcases. But, on the other hand, corporate America is lining the pockets of executives... http://www.ranum.com/security/homeland_security/editorials/Farewell_Do… http://www.ranum.com/security/computer_security/editorials/lawyers/ind… Additionally A Web 2.0 site may allow users to interact and collaborate with each other in a social media dialogue as creators of user-generated content in a virtual community, in contrast to Web sites where people are limited to the passive viewing of content. Examples of Web 2.0 include social networking sites, blogs, wikis, folksonomies, video sharing sites, hosted services, Web applications, and mashups.

An opposing viewpoint: http://www.ranum.com/security/computer_security/editorials/disclosure-…

Here's Marcus Ranum on Software Liability: Inviting Cockroaches to the Feast (http://www.ranum.com/security/computer_security/editorials/lawyers/ind…

Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb? Isn't this line inherently contradictory, how can a person make a system hack-proof ( as if it is possible ) if he doesn't know how to identify the vulnerabilities he could be introducing into it by doing something a particular way. Anyway the only good thing I got out of it was Personal Observations on the Reliability of the Space Shuttle by Richard Feynman(http://www.ranum.com/security/computer_security/editorials/dumb/feynma… its a better read than this article.

This may be only tangentially related, but something about AV has never sat well with me. For the record, I fall into the: "don't really use AV software, read mail in Mutt, never use IE under any circumstances, etc."-category so many of my attack vectors may be closed; I've never lost data from any sort of malware. Going back to what I was saying before, something about the approach of AV seems inelegant. This article[1] (point #2) sums up my sense of AV. With it, you're always playing catch-up and that seems weird. I just wanted to get others to weigh in on that idea. [1]: http://www.ranum.com/security/computer_security/editorials/dumb/

A decent read, but I much prefer his "Personal Observations on the reliability of the Shuttle" http://www.ranum.com/security/computer_security/editorials/dumb/feynma… It's of a lot of interest beyond simply the direct information about the space shuttle, mainly because of its discussion of reasonable risk taking, how to measure very remote probabilities, and the potential for a large disconnect between engineering and management with regards to safety measurement. And then of course it's about the space shuttle, so that's awesome.

Read http://www.ranum.com/security/computer_security/editorials/dumb/ Read it now.