[148923] in cryptography@c2.net mail archive
Re: [Cryptography] defaults, black boxes, APIs,
daemon@ATHENA.MIT.EDU (Marshall Clow)
Sat Jan 4 18:15:48 2014
X-Original-To: cryptography@metzdowd.com
From: Marshall Clow <mclow.lists@gmail.com>
In-Reply-To: <6FF4BC76-A241-446E-8F7B-8CE40FC2AA9B@lrw.com>
Date: Sat, 4 Jan 2014 13:09:45 -0800
To: Jerry Leichter <leichter@lrw.com>
Cc: Cryptography Mailing List <cryptography@metzdowd.com>,
Jon Callas <jon@callas.org>, John Kelsey <crypto.jmk@gmail.com>,
Bart Preneel <bart.preneel@esat.kuleuven.be>,
=?windows-1252?Q?Kriszti=E1n_Pint=E9r?= <pinterkr@gmail.com>,
ianG <iang@iang.org>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
On Jan 4, 2014, at 8:06 AM, Jerry Leichter <leichter@lrw.com> wrote:
> On Jan 4, 2014, at 5:22 AM, ianG wrote:
>> Have you noticed how the entire world is moving to a much more sophistic=
ated update model, typically dynamically, monthly? If you can do that, you=
don't need algorithm agility as a static tool.
> I would contend the dynamic, monthly update model is a sign of failure, n=
ot success. For it to be a success, it would have to be putting itself out=
of business - i.e., the quantity and severity of problems would be going d=
own over time, aiming for complete cessation in some visible future. In fa=
ct, there is no evidence I've seen that this is happening. Most likely, th=
e *opposite* is happening: One of the reasons we've gone to monthly update=
s is that the volume of individual updates was so large that people couldn'=
t keep up. And then we went to automatically, silently installed updates b=
ecause people couldn't even keep up with the monthly updates.
The =93best=94 part of the dynamic update systems that are currently in pla=
ce (Windows, Mac, iOS, etc), is the opportunity for a malicious actor to au=
tomatically push malware/spyware to a million devices at the same time - or=
(possibly even more chilling) to deliver targeted payloads to individual s=
ystems.
[ Broadly speaking ]
When you run =93software update=94, it sends a whole bunch of identifying i=
nformation back to (say) Apple. How much of this is unique to your machine?=
Or you?
Then the servers at (say) Apple send back a list of recommended updates, al=
ong with URLs for downloading the updates.
This setup is *designed* to deliver individualized updates.
=97 Marshall
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
