For 50 years, computer security has largely been built on the theory that most targets aren't worth the relatively high effort to compromise, so it's not worth it to spend the money on security. We're now reaching a point where the effort to compromise is dropping close to 0, which means we've got 50 years of insecure software to reckon for.
The advice today is the same as it has ever been, though. Always assume that any networked computer is or may become compromised. Do not do anything critical on a networked computer, because it is or may become compromised. You can still use computers, but assume that a bad actor may take control at any time, and plan for that eventuality.
For example, if you are hooking up a networked computer to your town's water supply system, ask yourself "what would happen if Iran got complete control of this system?" If you're putting your school system's students' mental health data into a networked computer, ask yourself "what would happen if all of this data became public?"
> The advice today is the same as it has ever been, though. Always assume that any networked computer is or may become compromised. Do not do anything critical on a networked computer, because it is or may become compromised.
This is completely unrealistic advice that 0% of people follow.
I agree it's rarely followed. I don't think it's unrealistic. No one needed to connect water infrastructure or student data into the Internet, but we did, and the obvious thing happened.
https://www.bbc.com/news/articles/c934dq95zpgo
https://duckduckgo.com/?t=fpas&q=public+schools+ransomware&i...
It might need to become a realistic view that >0% of people follow
Your on /hn/ and ¡¿don't?! have an entirely-local subnet, offline, for your NAS?
...with a hint of sarcasm, but the percentage is definitely a non-zero number.
In this scenario, is the Network-Attached Storage attached to the network (and so theoretically vulnerable)?
It seems like the only “safe” option is a PC (+storage) that never attaches to a network, but that extremely limits its usefulness.
This is correct; two of my three ZFS implementations are entirely local... the third (public-facing) covers the other twos' "limited usefulness."
Perhaps a vulnerability still exists (for one offline NAS, only): I use dedicated NICs (on each end) to direct-link my online NAS (which is otherwise local network, only, on a separate NIC), for routine backup.
Perhaps this leaves a bridge-LAN vulnerability?
But one is entirely offline, as are all its clients (dumb TVs, mostly).
Your NAS is not critical. The plan if your NAS gets compromised is to say "dang" and wipe it and re-download all your movies or whatever. You can connect that to the internet.
Stuff like your town's water, transportation, and medical infrastructure and employee and student data are critical. Your car's drivetrain and safety features are critical. Your home's HVAC can be critical in certain times of year. These things should not be connected to the Internet.
A better framing is that security has largely been built on theory that most targets aren't worth the effort to target, so security spending is focused on preventing/mitigating untargeted spray-and-pray attacks.
Computer security has largely been built on the “not enough bears” theory.
Every target is worth attacking, but there are not enough bears to eat everybody. Sure, the bears are breeding, but exponential growth does not look threatening until it suddenly is.
> Sure, the bears are breeding
I don't think the "breeding rate" was the limiting factor.
It reminds me of a bit from the book Lying For Money [0], where the author notes that you can often find multiple layers of scams attached to other scams, just like meta-parasite in biology.
[0] https://www.simonandschuster.com/books/Lying-for-Money/Dan-D...
Lotka-Volterra predator prey dynamics will emerge.
My new security through obscurity is to collect esoteric modern LLM written software, like this sweet gem of a terminal editor written in fortran: https://shithub.sh/fortrangoingonforty/facsimile
How do you transfer data then ? People walking with usb sticks ?? lol
It's very impractical, agreed, and even USB sticks, etc. have carried viruses.
Is any of this actually an LLM-related compromise?
> what would happen if Iran got complete control of this system?
What would happen if America got complete control of this system?
Oh wait. Oops.