Secrets and Lies

What Hacker News says

1. tmerseOct 2026
   Try the book: Bad Blood: Secrets and Lies in a Silicon Valley Startup
   thread
2. citrin_ruDec 2021
   Aside from language specific resource listed in other comments I recommend to read Secrets & Lies by Bruce Schneier as a small and easy to read introduction to digital security in general.
   thread
3. belornMar 2013
   Schneier talks about NAT and 2004 windows laptops (ie, with winxp). I actually asked Peter Gutmann during an IETF meeting around 2005, and he confirmed that nat had improved the situation around and win98/win2k/winxp windows machines and bot nets. If I recall right, the gist of it was that windows machines needed something, and while nat is wrong and bad, it "worked" in this aspect.

   This is about as far from a server installed with ubuntu in 2012 that one can get. You are not going to find any such article by Schneier promoting default firewall installations. I suggest here to check out Secrets and Lies by Schneier, as it is rather clear that a firewall need to be configured against the specific threats one can identify. If you fail at identifying threats, the firewall is likely not be useful at all, or will simply work identical to NAT. At worst, it will give a sense of false security.

   Show morethread
4. jamessNov 2008
   Your fundamental assumption is totally wrong. You simply cannot calculate the signature once and then store it and use it forever after, even for static content. That leaves you open to a whole class of attacks from a simple replay on up. To protect yourself, you'd need at minimum a nonce supplied by the client per request.

   You've given no thought to exactly what the signature would be over, nor how having one or more untrusted caches between you and the client might affect the content. If you think you can merely sign the payload, not the headers, think again. Where exactly do cookies live? What effect can the status line have on a client's behaviour? Now ask yourself, what are caches allowed to do a request without stepping outside the bounds of the standard? Yes, exactly.

   You haven't addressed at all how the client would even get hold of the public key needed to verify the signature. You haven't addressed what the signature is over in the event the server uses some content encoding like gzip, or the chunked encoding. You don't even add the obvious and trivial optimisation that the signature would be best sent as a trailer rather than a header, neither do you define the behaviour if the server wishes to send trailer fields after the HTTP payload.

   The only thing that can be concluded from this is that you don't really understand security or indeed HTTP. I'm baffled by the attitude that you admit you don't know anything about these topics, but you're trying contribute something to the field anyway. This is completely arse backwards, and in no other field of endeavour would anyone even consider tolerating it. Would a peer reviewed biology journal look kindly on me if I sent them my thoughts on protein folding? I think not.

   The attitude that any software engineer can do security is prevalent in the industry and gets us in to ridiculous amounts of trouble. You wouldn't believe how many software and hardware products I've seen that are completely broken security wise thanks to this. If you're interested in the field, I'd suggest starting by reading the canonical introductory text, Secrets and Lies .(http://www.schneier.com/book-sandl.html) This is not a field anyone is going to thank you if you want to learn on the job.

   Show morethread
5. idcrookOct 2026
   """How much of your opinion of her comes from the facts of her criminal case & how much comes from the images and/or videos and/or TV dramas you’ve seen over the years?"""

   There is a book by the WSJ reporter that uncovered the lies carrying the startup Theranos ("Bad Blood: Secrets and Lies in a Silicon Valley Startup" by John Carreyrou) and led to its downfall.

   There is a well-produced podcast ("The Dropout" by ABC News/ABC Audio) that also reveals the dichotomy between investor harm and patient harm and it was originally completed before the criminal trial.

   Would recommend those if someone is interested in the paths of the people involved in Theranos, and how they managed to carry on the deceptions.

   Show morethread
6. billsmithaustinMay 2023
   Bruce Schneier made a similar point in his book, “Secrets and Lies: Digital Security in a Networked World“. Quote:

   Society needs defectors. Groups benefit from the fact that some members do not follow the group norms. These are the outliers: the people who resist popular opinion for moral or other reasons. These are the people who invent new business models by copying and distributing music, movies, and books on the Internet. These are people like Copernicus and Galileo, who challenged official Church dogma on astronomy. These are the people who—to take a recent example—disrupt energy auctions to protest government responsibility for climate change. They're also people living on the edge of society: squatters, survivalists, artists, cults, communes, hermits, and those who live off the grid or off the land. In 2011, U.S. Marine Dakota Meyer received the Medal of Honor for saving three dozen of his comrades who were under enemy fire. The thing is, he disobeyed orders in order to do so.

   Show morethread