Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't see much value in this essay. What makes sense is rather old hat, and points like #3 are downright absurd, boiling down to, "You can't make a system more secure by finding weaknesses and correcting them - you must make the system magically devoid of weaknesses to begin with."

Somehow, if there was much of a way of doing that with non-trivial programs, I don't think we'd have security exploits anymore.




But the author mentioned qmail, which is an application that was built "secure by design", is non-trivial, and hasn't had many bugs. This is a little paper by the author of qmail: http://cr.yp.to/qmail/qmailsec-20071101.pdf


And yet there are still qmail exploits and fixes to those.

Not many people build insecure by design, but the simple truth is that security is both hard and always surmountable in some way.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: