Top all-time · #1674
Marcus Ranum
Personal blog · ranum.comsecuritywriting
Marcus Ranum writes Badger Forge, a personal blog at ranum.com about security and writing. Since 2007, 46 different Hacker News readers have linked it 72 times, most often “The six dumbest ideas in computer security (2005)”. The last post was in 2022, but the archive is still widely read.
Most-linked posts?
- The six dumbest ideas in computer security (2005)15 people · 33 mentions · first linked 2007-07-21
- Dumb Ideas in Computer Security (2005)7 people · 7 mentions · first linked 2008-08-27
- Personal observations on the reliability of the Shuttle – R.P. Feynman5 people · 5 mentions · first linked 2008-07-08
- The six dumbest ideas in computer security (2005)5 people · 5 mentions · first linked 2020-05-26
- /security/computer_security/papers/ai/2 people · 2 mentions · first linked 2015-12-02
- /security/computer_security/editorials/lawyers/index.html2 people · 2 mentions · first linked 2009-05-09
- The Six Dumbest Ideas in Computer Security (2005)2 people · 2 mentions · first linked 2019-09-10
What Hacker News says?
Well said. Security is a continuous process, not a product, checklist. If security isn't built in at all levels, the developers are creating more attack surface instead. The categories in your list are important, but I suggest adding what I consider the most important idea in security: stop designing features in a way that requires an enumeration of badness[1], aka default permit is always a bad idea. Checking for k…
Comment linking /security/computer_security/editorials/dumb/
on “A practical security guide for web developers”Submitted The six dumbest ideas in computer security (2005) as a story · 267 points
HN discussion> " They could've built their own rust-like language " They tried. Windows Longhorn was to be "entirely" managed code in the early 2000s, by 2004 they walked that back because vendors didn't want to rewrite their software for managed code and there were too many performance issues. Then they scrapped Longhorn altogether. As a research project they built: " Midori is an operating system that did not use Windows or Li…
Comment linking /security/computer_security/editorials/master-tzu/index.html
on “The Insecurity Industry”Submitted Dumb Ideas in Computer Security (2005) as a story · 114 points
HN discussion> the model of 'public by default, opt in for security' is fundamentally daft in this context. It's daft in most contexts, and is one of the largest sources of security problems. If your design requires enumerating badness [1], you're doing it wrong. > from: http://hackingdistributed.com/2017/07/20/parity-wallet-not-a... >> Just about every ICO, trust and company used the Parity multisig wallet, and that code was co…
Comment linking /security/computer_security/editorials/dumb/
on “A hacker stole $31M of Ether – how it happened, and what it means for Ethereum”Submitted The Six Dumbest Ideas in Computer Security as a story · 44 points
HN discussionMarcus J. Ranum's "Artificial Ignorance" concept is pretty good. I did an implementation and have been running it for more than 10 years: http://www.ranum.com/security/computer_security/papers/ai/ Someone's also done a Python implementation: https://github.com/lchamon/ai ...and it looks like there's one in syslog-ng Premium Edition: https://syslog-ng.com/documents/html/syslog-ng-pe-latest-gui...
Comment linking /security/computer_security/papers/ai/
on “Ask HN: How do you continuously monitor web logs for hack attempts?”Submitted The Six Dumbest Ideas in Computer Security as a story · 39 points
HN discussionTwo decades of experience suggests that "strengthening human security by training" ain't happening, no matter how hard/smart you try. The technical controls have to be beefed up to a point where that human-weak-link is eliminated. These tests are nothing but CISOs'(and Red Teams, and the whole industry around it) justifying their existence, and potentially doing a song-and-dance about it at the quarterly all-hands.…
Comment linking /security/computer_security/editorials/dumb/
on “Gitlab phished its own work-from-home staff, and 1 in 5 fell for it”Submitted The Six Dumbest Ideas in Computer Security (2005) as a story · 21 points
HN discussionCan we please stop trying to enumerate badness [1]? When parsing input it is possible to define the set of valid input, not all possible invalid inputs. Also, anybody accepting input from an untrusted source (such as anything from a network or the user) that isn't verifying the data with a formal recognizer is doing it wrong[2]. Instead of writing another weird machine, guarantee that the input is valid with a parse…
Comment linking /security/computer_security/editorials/dumb/
on “If your code accepts URIs as input, filter out “file://””Submitted Personal observations on the reliability of the Shuttle – R.P. Feynman as a story · 16 points
HN discussionWhile other's have brought up how ethanol in the style of (or sometimes literally) a very-high-proof vodka is used to treat methanol and ethylene glycol (antifreeze) poisoning, it is unlikely that these uses be seen outside of a hospital or other emergency medical facility. A better question is someone who is under the influence of something that is commonly prescribed, such as opioid painkillers[1], antihistamines[…
Comment linking /security/computer_security/editorials/dumb/
on “DEA Orchestrates Disinformation Campaign to Conceal Surveillance Powers”Submitted The Six Dumbest Ideas in Computer Security (2005) as a story · 7 points
HN discussionI feel like I was reading this from Marcus Ranum in 2005 in the famous article "Six dumbest ideas in computer security"[1] where he wrote about just running a custom webserver that accepts only correctly specified requests, instead of Apache and a filter set of bad-request-blockers and a default-permit firewall and etc. That article makes good re-reading in the "Penetrate and Patch" section now, in the days of AI ex…
Comment linking /security/computer_security/editorials/dumb/
on “Code-execution flaw in UEFI firmware threatens most servers on planet Earth”Submitted The Six Dumbest Ideas in Computer Security as a story · 6 points
HN discussionRight now, on one hand, we're spending billions of dollars for this Myth of Homeland Security in the hopes of protecting against terrorists, rogue states, and ideological nutcases. But, on the other hand, corporate America is lining the pockets of executives... http://www.ranum.com/security/homeland_security/editorials/F... http://www.ranum.com/security/computer_security/editorials/l... Additionally A Web 2.0 site m…
Comment linking /security/computer_security/editorials/lawyers/index.html
on “RFC 7258 – Pervasive Monitoring Is an Attack”Submitted The Six Dumbest Ideas in Computer Security (2005) as a story · 5 points
HN discussion> are not even addressable from the outside If your router is only doing NAT, they are addressable . A packet sent to a NAT-only router destined for 10.1.2.3 will simply be routed. It may have further address re-writing applied depending on the type of NAT, but that doesn't really matter - the packet will still go through. This could be accomplished with source routing, or an attack could simply originate one hop up…
Comment linking /security/computer_security/editorials/dumb/
on “IPv6 celebrates its 20th birthday by reaching 10% deployment”Submitted Personal Observations of Richard Feynman on the Challenger space shuttle as a story · 5 points
HN discussionI stumbled upon this (awesome) article that made me realize tons of things: http://www.ranum.com/security/computer_security/editorials/d... I'm not a security expert (far from it) but I hope that I understand enough the importance of security to learn a bit about it and implement it as much as I can. Secure defaults is now maybe the first concept I'm trying to explain to people in my company.
Comment linking /security/computer_security/editorials/dumb/index.html
on “The MongoDB hack and the importance of secure defaults”Submitted The Six Dumbest Ideas in Computer Security as a story · 4 points
HN discussion> IP blacklist Please stop trying to enumerate badness. This is and always will be incomplete. http://www.ranum.com/security/computer_security/editorials/d...
Comment linking /security/computer_security/editorials/dumb/
on “Webhooks do’s and dont’s: what we learned after integrating APIs”Submitted The Six Dumbest Ideas in Computer Security (2005) as a story · 4 points
HN discussion> Never blacklist. http://www.ranum.com/security/computer_security/editorials/d... "The Six Dumbest Ideas in Computer Security" #1) Default Permit ... #2) Enumerating Badness .., The unfortunately common assumption that security is about preventing badness has done an incredible amount of damage to security. We see it in everywhere. A huge amount of so-called "security" products (such as antivirus) are a futile exer…
Comment linking /security/computer_security/editorials/dumb/
on “The Basics of Web Application Security”Submitted The six dumbest ideas in computer security (2005) as a story · 3 points
HN discussion> Never allow all file types for upload by default, even if it is secure in your configuration The general form - never use default-allow - should be used in most situations where set of possible inputs cannot be exhaustively enumerated. In most situations, you cannot enumerate badness[1]. Instead of trying to define valid input by specifying it's inverse, it's far simpler (and safer) to use default-deny and specify…
Comment linking /security/computer_security/editorials/dumb/
on “Zero-day in jQuery plugin sample code exploited for at least three years”Submitted The Six Dumbest Ideas in Computer Security as a story · 3 points
HN discussionhttp://www.ranum.com/security/computer_security/editorials/d... "The Six Dumbest Ideas in Computer Security" > #1) Default Permit > #2) Enumerating Badness
Comment linking /security/computer_security/editorials/dumb/
on “Circumventing Deep Packet Inspection with Socat and Rot13”Submitted The Six Dumbest Ideas in Computer Security as a story · 2 points
HN discussion
