- From: Adrien de Croy <adrien@qbik.com>
- Date: Tue, 07 Apr 2009 11:41:03 +1200
- To: Michaeljohn Clement <mj@mjclement.com>
- CC: Daniel Stenberg <daniel@haxx.se>, HTTP Working Group <ietf-http-wg@w3.org>
Michaeljohn Clement wrote: > Daniel Stenberg wrote: > >> On Mon, 6 Apr 2009, Adam Barth wrote: >> >>> Here the situation is reversed. Diversity leads to increased security >>> risk because mismatches in sniffing create cracks that attackers can >>> exploit. >>> >> No, that's the exact same situation as in biology. If there's a single >> master race with no quirks, it will conquer them all. But if that master >> has a flaw, everyone gets hit. >> > > Ah, the dangers of taking an analogy too far... > > In biology we usually talk about whether a species survives or not. > The analogy fails because in browser security, having an exploitable > hole in one browser is unacceptable. The goal isn't to throw a range > of genetic diversity against a potential extinction event and hope that > a few individuals make it alive out the other side; the goal is to > provide a secure browsing experience for *all* users. > sure that's the goal. But what if you get the algorithm wrong? It's still humans designing this right? If there is an exploit to the algorithm, then potentially any browser that uses it is vulnerable. It's difficult to foresee the future. It's also difficult to guarantee that the algorithm will be bullet-proof forever and withstand any attack. The potential down-side if all browsers are found to have a vulnerability is difficult to estimate. It could be enormous. > -Michaeljohn > > -- Adrien de Croy - WinGate Proxy Server - http://www.wingate.com
Received on Monday, 6 April 2009 23:38:38 UTC