{"id":58762,"date":"2022-08-26T08:19:08","date_gmt":"2022-08-26T12:19:08","guid":{"rendered":"http:\/\/pappp.net\/?guid=e04eab24ce25979980825471d58e196c"},"modified":"2022-08-26T08:19:08","modified_gmt":"2022-08-26T12:19:08","slug":"security-and-cheap-complexity","status":"publish","type":"post","link":"https:\/\/pappp.net\/?p=58762","title":{"rendered":"Security and Cheap Complexity"},"content":{"rendered":"

Source: Schneier on Security<\/a><\/p>\n

Article note: I'm not sure why it's doing the rounds this week, but it's a really good observation.<\/div>

I’ve been saying that complexity is the worst enemy of security for a long time now. (Here’s<\/a> me in 1999.) And it’s been true for a long time.<\/p>\n

In 2018, Thomas Dullien of Google’s Project Zero talked<\/a> about<\/a> “cheap complexity.” Andrew Appel summarizes<\/a>:<\/p>\n

The anomaly of cheap complexity. For most of human history, a more complex device was more expensive to build than a simpler device. This is not the case in modern computing. It is often more cost-effective to take a very complicated device, and make it simulate simplicity, than to make a simpler device. This is because of economies of scale: complex general-purpose CPUs are cheap. On the other hand, custom-designed, simpler<\/i>, application-specific devices, which could in principle be much more secure, are very expensive.<\/p>\n

This is driven by two fundamental principles in computing: Universal computation<\/i>, meaning that any computer can simulate any other; and Moore’s law<\/i>, predicting that each year the number of transistors on a chip will grow exponentially. ARM Cortex-M0 CPUs cost pennies, though they are more powerful than some supercomputers of the 20th century.<\/p>\n

The same is true in the software layers. A (huge and complex) general-purpose operating system is free, but a simpler, custom-designed, perhaps more secure OS would be very expensive to build. Or as Dullien asks, “How did this research code someone wrote in two weeks 20 years ago end up in a billion devices?”<\/p><\/blockquote>\n

This is correct. Today, it’s easier to build complex systems than it is to build simple ones. As recently as twenty years ago, if you wanted to build a refrigerator you would create custom refrigerator controller hardware and embedded software. Today, you just grab some standard microcontroller off the shelf and write a software application for it. And that microcontroller already comes with an IP stack, a microphone, a video port, Bluetooth, and a whole lot more. And since those features are there, engineers use them.<\/p>","protected":false},"excerpt":{"rendered":"

I\u2019ve been saying that complexity is the worst enemy of security for a long time now. (Here…<\/p>\n

Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226],"tags":[],"class_list":["post-58762","post","type-post","status-publish","format-standard","hentry","category-news-2"],"_links":{"self":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/58762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=58762"}],"version-history":[{"count":0,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/58762\/revisions"}],"wp:attachment":[{"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=58762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=58762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=58762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}