Article: Why Bloat Is Still Software’s Biggest Vulnerability

The security of software depends on two factors—the density of security issues in the source code and the sheer amount of code accessible by hackers.

The world ships too much code, most of it by third parties, sometimes unintended, most of it uninspected. Because of this, there is a huge attack surface full of mediocre code. Efforts are ongoing to improve the quality of code itself, but many exploits are due to logic fails, and less progress has been made scanning for those. Meanwhile, great strides could be made by paring down just how much code we expose to the world. This will increase time to market for products, but legislation [in the European Union] should force vendors to take security more seriously.

5 Likes

great article, thanks for sharing. I had never heard of Hubert. I was not aware–and I read everything–how much of our digital lives depend on un-audited code independent of proprietary in many cases…(we all know about proprietary. His thesis really harkens back to his (spiritual mentor as I see it) mentor’s '95 call for simpler code.
you will never mitigate the damage when their is too many chiefs; too many interests.

as a (hopefully) smart user I can make the right decisions to avoid much of the hard-wired bloat he describes. we already know the risks the foss stuff has.

he touched on the biggest logical fallacy many believe: “The assumption is then that the cloud is somehow able to make insecure software trustworthy.” how could it be anything but the opposite to a thinking person?

it was all about the software to Hubert but what scares the crap out of me is you can’t audit or scan or even know to to look for hardware / firmware infections. this is the biggest attack vector right now because it’s easy to get in and easy to stay invisible. mostly undetectable :clown_face:-to-server stuff.
But I digress. Eye-opening reading.

1 Like

0_BLOAT


This will increase time to market for products, but legislation [in the European Union] should force vendors to take security more seriously.

honka_animated-128px-4

I’d rather see shittiest software ever written but free, without :clown_face: union “forcing” anything.

1 Like

I remember a bit of that 1995 article that was discussed around the coffee table and my Lineman master corporal had just bought a 450mhz intel Cpu and told us that it would become obsolete in a short time because software was becoming bigger and bigger …

Very good article indeed. Thanks for sharing :handshake:

1 Like