frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Ask HN: Is Security Just Busywork?

2•YukiBits•2h ago
How many devices with computers (i.e., embedded systems) need regular updates? My microwave oven, dishwasher, and coffee machine don’t need an (firmware) update. Why can’t we just write software like firmware once and run it indefinitely like we do with embedded systems? Why can’t I connect a Windows XP computer to the internet? I mean because it gets malware, yes. But why is an internet connection such a threat to software like operating systems? Everything connected to the internet seems to require constant „security“ updates. Once those security updates come to a stop, you suddenly cannot safely use your device on an internet connection.

Why is it not possible to have software written without constantly updating its „security“?

Is „security“ just a form of collective busywork, or is it really justified and necessary?

The internet seems to make every computer insecure. Is it by (inherit) design or by choice? Is the culprit indirection (i.e, abstraction)? Are CPUs inherently insecure? Does it mean that layers of indirection are inherently harmful? What is ultimately causing this? Please don’t say anything along the lines of „policemen need criminals to justify their jobs“.

Is there even a computer system that can be connected to the internet that does not require any updates? Don’t say mechanical computers, or a calculator please, or a Turing machine, please.

What is the ultimate reason for the constant need of security updates when it comes to computers connected to the internet?

I mean, I am aware that you can inject malware with a USB pen drive or any external device that can be connected to the computer. But why are computers so fragile when connected in any shape or form to the „outside world“?

Why so fragile?

Comments

Bender•1h ago
Is Security Just Busywork?

No. They build a thing and expect money. Customers do not have a binding contract with most of these vendors and there is no expectation that they will make any effort to protect you or your family thus it is currently on the consumer to protect themselves from their internet connected devices. Strict legislation in every country with serious consequences would be required to change this. That or cutting on trade with countries that harm consumers and that is a high bar to meet. Not likely to happen.

al_borland•1h ago
My microwave and dishwasher don’t need updates because they don’t connect to the internet and they are also very simple machines. They essentially run pre-programmed processes centered around a timer.

Internet connected computers have complexity that is several orders of magnitude greater than those simple appliances. This is much harder to get right and test every possibility. The internet allows access for people to exploit those untested or unhandled possibilities.

On top of that, the very ability to update remotely lets companies prioritize release dates over completeness, because they can ship it and update it later if anything is found. It becomes a cost benefit analysis. How much will a security incident cost vs the cost of delaying the product? What are the odds a vulnerability gets exploited before they can find and patch it?

Internet connected appliances create busywork, imo. They don’t need those features, so the initial design takes more time, adds complexity, and then creates perpetual maintenance to keep things secure and working with the supporting backend services. All of this feels like needless theater to give customers something most don’t even want. I’ve never seen anyone excited about their biweekly TV update prompt.

YukiBits•1h ago
So in other words, it is pretty much hopeless to make secure software for computers connected to the internet or outside world that lasts long enough (and takes little maintenance). The reason being, because we cannot deal with complexity against all eventualities? Even if we have relatively simple abstractions and tools in place?

I can see that you may point to other areas of human engineering such as bridges, buildings, vehicles. All can fail given the right circumstances. I am not asking for an unbreakable engineering product. That seems to be rather impossible.

But I would still argue that the „security updates“ for engineering artifacts like bridges don’t need frequent „updates“ (i.e., maintenance, inspections).

Computers seem to be relatively more fragile unlike any analog engineering artifact in existence. Some soldiers still need to know how to navigate with a sextant, because computer systems seem inherently fragile.

I can think of software dependencies that break constantly (e.g., Scala, Python). Are you going to tell me that a bridge is more fragile than some Ruby package?

So in other words, how is it possible that anything having to do with computers is seemingly more prone to fail than a building, a bridge, a Cessna 172? Yes all those classic engineering artifacts need constant maintenance, but I would argue that it is unlike (modern) software.

So my point is the fragility of software seems to require more maintenance (i.e., security updates) than any other human engineering artifact.

That seems unfortunate. Software shall be rather something like a building (withstanding wind, earthquakes, …) and taking relatively low maintenance.

I just don’t understand why it requires frequent maintenance and „fixes“ within a given year. Your smartphone does, your Windows 11 computer does, your Samsung TV does. Your „smart“ vehicle does.

What is the ultimate reason that computer software cannot be like the other avenues of engineering?

Economic interests cannot be the sole culprit. Free software like Debian needs fixes too.

One C++ header file retro game engine

https://github.com/OneLoneCoder/olcPixelGameEngine
1•mariogianota•16s ago•0 comments

Claude Code and core dumps: Finding the radio stream that hosed our servers

https://blog.marcua.net/2026/01/28/claude-code-and-core-dumps.html
1•marcua•52s ago•0 comments

Mousefood – Build embedded terminal UIs for microcontrollers

https://github.com/ratatui/mousefood
1•orhunp_•1m ago•0 comments

US tobacco brands bypass Instagram rules restricting youth access to content

https://bmjgroup.com/major-us-tobacco-brands-flouting-platform-federal-policies-to-restrict-young...
1•giuliomagnifico•1m ago•0 comments

AutoSP: Unlocking Long-Context LLM Training via Compiler-Based SP (ICLR 2026)

https://openreview.net/pdf?id=0fgsHvmBBI
1•matt_d•1m ago•0 comments

HARMless – ARM64 ELF Packer for Linux Security Research

https://github.com/litemars/hARMless
1•litemars•3m ago•1 comments

Software in a Post-Abundance World

https://newsletter.terminalprompt.com/p/software-in-a-post-abundance-world
1•joaoqalves•4m ago•0 comments

Snap spins off smart glasses team into separate company

https://www.neowin.net/news/snap-spins-off-smart-glasses-team-into-separate-company/
1•bundie•5m ago•0 comments

DanceJump for YouTube – Rhythm Dance Game – v0.3.3 Released

https://chromewebstore.google.com/detail/dancejump-for-youtube-rhy/hhdeflibphdghcpblkekakmbennfcaci
1•maaydin•5m ago•1 comments

Moderators on Reddit's R/programming are a bunch of wankers

1•mariogianota•6m ago•0 comments

Google settles for $68M after lawsuit claimed it recorded users

https://thehill.com/homenews/nexstar_media_wire/5707309-google-settles-for-68-million-after-lawsu...
1•kyrofa•6m ago•0 comments

The Ipe extensible drawing editor

https://ipe-web.otfried.org/index.html
1•remywang•7m ago•0 comments

Taghash launches services layer to streamline fund operations and compliance

https://entrackr.com/snippets/taghash-launches-services-layer-to-streamline-fund-operations-and-c...
1•koolhead17•8m ago•0 comments

How to Build a Copilot Agent

https://www.honeybadger.io/blog/copilot-custom-agents/
1•mooreds•8m ago•0 comments

New AI Agent 'Clawdbot' Exposes Users to Remote Hijacking – The Shib Daily

https://news.shib.io/2026/01/27/new-ai-agent-clawdbot-exposes-users-to-remote-hijacking/
1•ereli1•8m ago•0 comments

Yarn 6 Preview

https://yarn6.netlify.app/blog/2026-01-28-yarn-6-preview/
1•jakub_g•9m ago•0 comments

A Treatise on AI Chatbots Undermining the Enlightenment

https://maggieappleton.com/ai-enlightenment
1•colinprince•9m ago•0 comments

Ask HN: Home Security for Home Owners

1•a_lifters_life•10m ago•0 comments

Computer History Museum Opens Virtually

https://hackaday.com/2026/01/28/computer-history-museum-opens-virtually/
1•oldnetguy•12m ago•0 comments

Bellingcat supplements local news coverage with forensic analysis in U.S. cities

https://www.niemanlab.org/2026/01/in-minneapolis-and-other-u-s-cities-bellingcat-supplements-loca...
2•giuliomagnifico•12m ago•0 comments

28th Virginia Battle Flag

https://en.wikipedia.org/wiki/28th_Virginia_battle_flag
1•nappy-doo•12m ago•0 comments

Two Cities Under Siege

https://radleybalko.substack.com/p/two-cities-under-siege
1•speckx•13m ago•0 comments

FOSDEM 2026 Schedule

https://fosdem.org/2026/schedule/
1•weinzierl•13m ago•0 comments

Favourite well-made apps and sites

https://unsung.aresluna.org/favourite-well-made-apps-and-sites/
1•colinprince•13m ago•0 comments

From Random Idea (AI) to 600 Users (and Shutdown) in 4 Months

https://ryanranas.medium.com/from-random-idea-ai-to-600-users-and-shutdown-in-4-months-974d4cb76848
1•ryanrana•14m ago•0 comments

Ask HN: Need for AI usage disclosure system?

1•seagram•15m ago•0 comments

Show HN: RFX-Fuse: Breiman and Cutler's Random Forest + Explainable Similarity

https://github.com/chriskuchar/RFX-Fuse
1•ck33•17m ago•1 comments

All Your Parking Tickets Are Belong to Me

https://www.jack.bio/blog/parkingtickets
2•fanf2•17m ago•0 comments

AEV's New Ford FXL Package Will Put Your Super Duty on 40s

https://www.thedrive.com/news/aevs-new-ford-fxl-package-will-put-your-super-duty-on-40s
1•PaulHoule•18m ago•0 comments

Payment processors were against CSAM until Grok started making it

https://www.theverge.com/ai-artificial-intelligence/867874/stripe-visa-mastercard-amex-csam-grok
1•jmsflknr•19m ago•0 comments