The Six Dumbest Ideas in Computer Security
www.ranum.com

This is an article that is now over twenty years old.

And yet posting it seems like a worthwhile refresher for the “Agentic Age” … because very basic principles are being thrown overboard.

One is: There has to be a clear separation between code that controls actions on your computer, and untrusted data.

Looking at agentic systems - what do you see?

  • pulsewidth@lemmy.worldEnglish
    2·
    14 hours ago

    The point about ‘educating users’ being dumb is itself incredibly stupid, because the largest element of hacking is social engineering: the letter from a nigerian prince, the zip file from an attractive person with ‘my hot photos enclosed’, to today’s calls from government impersonators (tax agency, immigration), and emergency requests from close known contacts that ‘urgently need money wired to them’.

    Education has gone a long way to improving user response and caution against default trust of unverified contact, which is essentially what the first two points complain about from a technical aspect (default allow). Those complaints are at odds with one-another.

    • HaraldvonBlauzahn@feddit.orgOPEnglish
      2·
      9 hours ago

      Education has gone a long way to improving user response and caution against default trust of unverified contact

      If that were true, nobody would run agentic tools.

      Because these:

      • perform actions on your computer, thus are executing programs
      • operate on untrusted data -cannot, by principle, safely discern between commands and untrusted data