[Cryptography] best practices considered bad term

[ianG]

On 3/02/2015 11:46 am, Jerry Leichter wrote:
> On Feb 2, 2015, at 11:13 PM, Viktor Dukhovni <cryptography at dukhovni.org> wrote:
>> I am currently involved in two starkly different OSS projects (also
>> others, but these two are extremes on the security track-record
>> spectrum), the first since 2001 and the second only recently.
>>
>> In the first project:
> <excellent enumeration of some of the stark differences in development practices between projects>
>> So indeed, just being open-source does not ensure security....
> I've seen similar contrasts between *commercial* projects.
>
> Unfortunately, the economics of the marketplace - whether it's a matter of the actual sales needed to keep a commercial project going, or the adoption and ongoing interest that provides the people and ongoing interest to keep an OSS project going - pushes hard against measures of internal quality and care.  Such projects are very few and far between.
>
> Apple has figured out a way to sell *external* care and quality.  (Whether you, personally, like their designs isn't the point - enough people do, and are willing to pay to show that they do, to make it as successful as it is.)  Back in the heyday of Windows, no one (outside of a then-tiny and insignificant group of Apple groupies) believed that this could possibly matter.  "What people want is the cheapest possible PC."  Or phone, or whatever.  Time to market dominates all - first-mover advantage, yada yada yada,  You still hear those arguments made all the time when it comes to security.
>
> So far no one has managed to find the way to market the qualities that emerge from solid internal design and care.


I'm not so sure.  If you look at the 2000s, Apple shipped gear that was 
remarkably free from bugs and attacks.  Their security bug list was in 
the 3 figures whereas Microsoft was in the 5 figures.  I suspect that is 
still the case, although I don't track it.

Now, here's the sell:  Over the 2000s, people drained out of the 
Microsoft world to the Apple Mac OSX world pretty consistently.  At the 
start, Apple was tiny.  At the end, the biggest.

And -- my hypothesis -- they did that in significant part because the 
Mac OSX product was more secure.  By this I mean, no requirement to run 
virus scanners, and until last few years, very little update and change 
requirement.  Which meant more time and more $$$ in users' pockets.

The fact that this happened slowly, user by user, outside the stores and 
support channels, meant that the security journos and pundits and 
experts simply didn't notice.

I'd say, *in the long run*, Apple beat Microsoft on software security. 
It helped that their hardware was good too, and that they had the sense 
to aim for the premium price range.  By that, I mean Jobs took the long 
view, a decade.  Wouldn't fly in other circumstances of course.



iang