The Times' John Markoff has a long piece in the paper today to make the point that:
… there is a growing belief among engineers and security experts that Internet security and privacy have become so maddeningly elusive that the only way to fix the problem is to start over.
What a new Internet might look like is still widely debated, but one alternative would, in effect, create a “gated community” where users would give up their anonymity and certain freedoms in return for safety. Today that is already the case for many corporate and government Internet users. As a new and more secure network becomes widely adopted, the current Internet might end up as the bad neighborhood of cyberspace. You would enter at your own risk and keep an eye over your shoulder while you were there.
Now, I think Markoff is a tremendous reporter. Indeed, in at least one job interview, but probably more, when asked what reporters I admire I list Markoff and John Fraser — but when you write a story about how dangerous the Internet has become and cite as your sources for that observation people who will sell you software to protect you against that danger, well, I begin to wonder. Markoff also cites some researchers at Stanford, which is certainly a school that's produced a lot of computer and telecom innovations but it's also the school Markoff teaches at. (That point is not disclosed in the piece.)
Now, to be fair, Markoff interviews Purdue's Gene Spafford for the piece and he should — I would if I was writing about the state of Internet security — but Markoff — for whatever reason (the piece is in the Times' Review section — maybe the editors there forced him to take all the geek-speak out. It's happened to me before …) we don't learn much about Spafford's diagnosis of the problem, a diagnosis which, it seems to me, doesn't require a completely new Internet where I have to give up my anonymity for safety:
OSes, overly-permissive email, firewalls, anti-virus that is unable to keep up with the threat, and on and on. Not only are most of these poorly thought out from a security point of view, they are all designed to provide too many generic, permissive services to the widest possible client base. That may be good business but poor security planning. And much of the security solution space is limited responses to specific threats that continue to prop up the rest of the poorly-designed base.
…
The number 1 change we need to make is to understand that issues of security, safety and reliability are not easily measured and deploying the cheapest upfront solution is not consistent with trusted systems. The impact of that would go deep, including into the design of the software we run on our systems. Note that this is true of any security — airport, computer, home or national security. There is a cost involved, and always residual risk.
We have chosen to standardize on a small set of very complex items because some people think they are cheaper to acquire and maintain….based on experiences gained 15-20 years ago with different platforms. Those estimates also don't bear in mind the costs of security, reliability, and other important factors. But until we change the mindset about up-front cost trumping all else, we can't win.
We have to change the way we educate software designers, and the way we hold companies accountable for flaws in code.
We must do a better job investigating and prosecuting computer crime.
These are not fundamentally big shifts in technology — we have the technology for many of these issues now. We simply lack the will to apply it.
I'm not going into detail, because I doubt there are many who really want the answers. They want their Windows machines, on-line games, animated WWW apps, iPods and universal connectivity.
That's from a rant of Spafford's that Dave Farber put out on his list on Dec. 11 (and I'm almost positive Markoff is on Farber's list). It's a shame Markoff didn't explore some of those ideas a bit further and question the assumptions of the Stanford researchers — and others — a bit further.
But back to the basic problem as I see it: It ain't the Internet that's the problem so much as its users.
I had my first e-mail account in (I think) 1987 or 1988. Since then, I have been running around the Internet using machines running DOS, Windows, and Mac operating systems. My home machines have never — never! – been infected with a virus and, so far as I know, no one's stolen my credit card number or my identity. I'm a liberal arts grad, not an electrical engineer, and all I'm pretty sure I've done to enjoy such good fortune is exercise a little common sense.
On the corporate networks I've been on, I've seen one security problem hit home. A virus knocked out the network for a company I once worked for for a few weeks. (That company, incidentally, was running Microsoft server products and a Microsoft operating system on its desktops. If you're running a server, why wouldn't you run OpenBSD? That, my friends, is what the Pentagon uses for its mission-critical, ultra-sensitive servers. The price for that server product: Nuthin'. It's open source.) My point here is: Time and time again, we've heard, mostly from companies who sell computer security products, that the world is ending, that there is a monster virus out there that's about to pull the whole thing down. I'm not convinced. Exercise a little common sense when you compute and I'm sure we'll all be fine.
In any event: If you build a new Internet and you want me to get a license to drive on it, sorry. I'm hanging out here in v.1.
Ever since I heard him present at a