Apathy in the Security Community

I've been traveling a lot lately. I've seen a lot of interesting things, done some interesting things, and talked with some interesting people, some boring people, and some legitimate crazies. I have a lot of material to discuss, and a lot to ponder.

I mentioned in a previous blog post that Black Hat and Defcon left me with some insights into the world of security, and they were largely confirmed in the past weeks. Here are a few random thoughts and reactions:

The hacker community is getting stale. Sure, the attendee numbers at conferences are still growing, but in most cases, the hacker mentality just isn't there. Before I get flamed, yes, I know that it was always a small core of people, and those people are still there. In addition, I'm actually all for having the noobs show up at Defcon, just to get a taste of what we're all about. But... I keep thinking that when I go to these events, the excited-to-be-here and stoked-to-do-things vibe isn't nearly as strong as it was just a few years ago. Geeks aren't particularly social people- I can deal with that, but I'm seeing a lot of people who are just there to be there. I guess that happens in every community- I've seen the same thing happen various other communities over the years, but I really don't like the idea of it happening to the hacker scene.

That said, there are always some bright spots. At Toorcon, I happened to be watching as two attendees rigged the candycorn-counting-contest. One asked the staff at the registration desk to stand up and face him for a photograph, and the other walked by and swapped out the jar of candycorns while their backs were turned. Most places, this kind of cheating would be unacceptable behavior, but at a hacker convention... I'm disappointed when I don't see it.

Short version... I dunno... I just want to see the attendees get more involved in those things. It's more fun that way anyways. You don't have to be a 1337 haxx0r who hasn't showered all week to make exciting things happen.

On the other side of a fast-growing split between the security community and the hacker community, we're seeing the same problem. I was in DC for CSI this week. I spoke on a 3-hour web security panel with Rafal Los, Joshua Abraham, Jennifer Jabbusch, and Sharon Besser. The people on the panel were smart, lively, and passionate about what they did. We had a great discussion. The people in the audience though... they didn't really care what was going on. I get the impression that half of them were just there for CPE credits, and the other half were government employees looking for a paid vacation. The fact that these people are tasked with securing data in both the government and corporate worlds scares the crap out of me.

There were a few people there who were willing to ask questions and actively participate in the discussion, but they were the exceptions. I don't understand how a person can work in security and not be extremely passionate about his job. We do very cool work here and we work with very interesting people. Having spent time in a lot of other industries, I can honestly say that I've never worked with a better group of people. What's more, if you aren't passionate about it, there is no way you can keep up. The security world changes daily, and while we joke about our addictions to our smartphones, email, and twitter, if you take a few days off, you really will get left behind. It takes serious commitment just to keep up, but it's totally worth it.

If you're one of those people who just doesn't care, get out of this industry. There's got to be a better use for your time. If you do want to stick around, find a project to work on, something to get involved in, or at least start a blog with random thoughts. Even if you're wrong, ridiculed, and flamed, it's helpful to you, the community, and everybody else.

Maybe I'm an idealist, but I just want to see other people get as excited as I am.

Browser Security Tools: RequestPolicy

Note: I originally posted this piece on my employer's blog. I'm shamelessly cross-posting it because this is a really cool extension, and I want lots of people to check it out.

I spoke about CSRF attacks at Defcon a few months ago, and while I was there, I had the opportunity to meet with Justin Samuel, the creator of RequestPolicy. RequestPolicy is a Firefox extension designed to provide CSRF protection and enforce web application boundaries. I love it.

Request Policy completely breaks the web... in all the right ways. You'll initially hate using it. StumbleUpon links will no longer work, due to their use of cross-site iframes. Shortened bit.ly and tinyurl links will present you with an intermediate page instead of following 302 redirects. Deeplinked images on blogs, social networking sites, and other pages won't show up. You will have to manually approve off-domain requests on a case-by-case basis. It's not convenient, but it's a lot safer than letting your browser blindly request resources.

In short, RequestPolicy gives you granular control over your browser. If you know what you're doing, this is a good thing. If you're a normal user, you'll probably find yourself checking the "Temporarily Allow All Requests" box or disabling the extension completely. I can't say I'd blame you, but try not to. The extension is still very young in its development process, and most of the issues that I've run into are UI/usability problems. The developer is aware of many of these issues and working to fix them, but it's not easy. Samuel is very open to suggestions, feedback, and criticism, so if you have useful input, I'm sure he'd be happy to hear it- just hit the contact link on the extension's website.

The UI is heavily modeled after NoScript, so if you're a fan of that extension (and you should be), it isn't too difficult to figure out. Off-domain requests are disabled by default, and can be enabled on a per-site, as-needed basis. The preferences pane is simple and fairly easy to understand, allowing you to more easily manage your whitelist of allowed domains. Additionally, the extension ships with a setup wizard to create generic whitelists based on common sites (recaptcha, for example, has to be whitelisted for every domain that uses it). All in all, it's pretty easy to set up, and though it will break a lot of sites at first, as you fine tune the settings to your browsing habits, it really doesn't get in the way too much.

RequestPolicy was created for a very specific purpose: to give users the ability to better control their browsers and prevent CSRF. It's a bit rough at the moment, but it's very good at it.