Package Managers

I try to avoid projects which make use of package managers.

I understand the convenience and that you can lock dependencies to a specific version. And normally it would be feasible to audit it. But people which use package managers reached a tier of insanity, where they end up with so much transitive dependencies, which makes it impossible to audit it.

However, this could also happen with vendored dependencies, but it is less likely, since vendoring requires you to do many steps manually. And people which do a lot of things manually tend to be more aware and careful what they include.

Curl piped to sh

This pattern:

curl --proto '=https' --tlsv1.2 -sSf https://sh.example.foo | sh

Don't do it.

Bug Bounties

Bug Bounties are a good idea at first glance. A researcher finds some exploit, reports it and gets rewarded. The company benefits from a more secure and stable software. Win-Win.

But some companies employ very restrictive rules or just don't agree on the common 90 days disclosure agreement. They basically disallow you to speak about your findings while fixing nothing.

You must be aware that some companies are just using Bug Bounty programs as PR stunt. They're not really interested in any findings or they just downplay the issue.

JWT

The JSON Web Token attempts to solve database roundtrips for logins.

Usually, the user provides some credentials, then the server validates them against the database. With JWT we do not need to talk to the database anymore, we can recompute the signature from the JWT with the public key and compare the results.

However, as soon as you need to invalidate the key (logout or security reasons), the concept falls apart.

Since the server does not keep track of the tokens, you can only invalidate them if they expire. There are several different solutions that work around that issue, but in the end they store a blocklist in a database.

Lowering Standards

Over the years I observed how family, friends, and coworkers lowered their standards regarding software.

For example, if the GUI is broken to some extent but still usable, it's mostly fine for them, at least it works somehow.

But this mentality is wrong and leads to even more broken software. Companies are aware of this sentiment and are slacking off even more.

Instead, raise your standards! Humanity solved so many problems in computer science, especially GUI.
In the 90s, Apple ^[PDF] and Microsoft ^[PDF] did extensive research on UI/UX.

And companies today like Spotify, Apple itself, Youtube, Discord, and more violate those guidelines.

That being said, if a company isn't able to make the UI work, let them know!

Security and your Paranoia Level

When I'm asked how to secure an IT system, I often respond with a very unsatisfying answer.

The reality is that we cannot validate most systems we use. For example CPUs have their own OS with their own network stack. Intel calls it "Management Engine", AMD calls it "Platform Security Processor".

Both systems have been criticized for potentially acting as a backdoor, or misused by governments.
Knowing that, it feels like we're building an illusion of security, neglecting the fact that there's a bigger issue lurking around.

So my answer to the question of how to secure an IT system, is "depends on your paranoia level".

To my knowledge, there's no known real-world exploitation of those CPU engines yet. So I would assume the ordinary individual and companies which do not provide critical infrastructure might be fine.

As soon as you're doing something where someone's life is on the line, I would consider doing further hardening and treat the device as if it were 100% compromised, should it gain network access or be contaminated by thumb drives.