It traces the shady underbelly of the computer industry - the exploit/vulnerability markets, and goes very deeply into “Teh Cyberz” in the process. A particularly solid set of chapters early on is on Project Gunman, James Gosler, and Olympic Games. If you’re not familiar with the state of the past couple decades of computer security, that might mean nothing. You will be well informed. If you are - then you’ve probably shuddered, just a little bit. For one of several possible reasons.
This is one of those books that makes a compelling case that no matter how bad you think the state of computer security is, it’s worse. By far. Because there are a lot of people, and a metric crapton of money, devoted to making it so. “Hack the planet!” is apparently alive and well, many years after Hackers came out.
I can’t decide if the right answer is to spend an awful lot of time trying to help shore up the “Well, it’s all broken, but let’s build something that’s a royal pain in the ass anyway” projects like Qubes and some of the PinePhone stuff, or if I should literally just give up on computers in personal use and go learn to garden better.
Anyway, very highly recommended read. Just terrifying.
I found this to be an interesting read but man, you really have to get over the author’s hard-on for the neoliberal political order. It feels too that there’s an implicit anti-Russian bias here which is, according to the material presented, entirely undeserved (if anything there should have been an anti-Israel bias, looking at who’s enabled the worst offences with the most powerful tools).
Anyways, if you get past the politics, it’s a decent, if repetitive, read, and it certainly puts the point on many many things I’ve long been theoretically concerned about (for decades, and it turns out I was right to have been concerned about them back that far).
I’m with you, @Syonyk, in thinking gardening makes more sense than whatever passes for “computing”…
That’s not really true in the cyber realm. This book (and others) make an argument (which I agree with) that just about everything is compromised, the only questions are “By how many actors?” and “What are they going to do, or what could they do?”
This book talks about some of the “compromise at scale” techniques used, and I fully believe they’re effective. If it’s connected to the internet, it’s probably able to be compromised.
Defense in depth relies on things like “firewalls” and “routers” and such, all of which are probably compromised entry points anyway.
One of the things I’ve been wondering about now, which I think I also have an answer to, is “What happened to viruses/worms/malware/etc in the late 90s to early-mid 2000s?”
There were some properly good late DOS era viruses - polymorphic, encrypted, nerfed AV on contact, etc. And then they just disappeared. For most of a decade. There wasn’t much you saw about Windows viruses, and half the stuff you did see was just “Hi Moms” - crap that made noise to make noise. What happened to the people who were writing the late DOS era stuff? Did they just hate Windows and stop? Or was the stuff so buried that we never found it?
I’m more and more inclined to believe that they perfected their craft and we simply stopped finding the stuff for a decade.
It’s a struggle for sure. I could do some useful things in the space, I know my way around it decently. But I’m just not sure I care to put the effort in… or that it would be worth anything more than prolonging the collapse of the piles of complexity.
Depends on the actor - if an well resourced entity is directly is after you, you’re fuxed. So ‘defense in depth’ might very well mean separating your computing - critical stuff goes into offline systems or ‘cold’ systems and hope no one is doing a stuxnet on ya.
