> 'I don't want to spend time segregating permissions and want a do-anything machine.'
Yes. It's a valid goal, and we'll keep pursuing it because it's a valid goal. There is no universal solution to this, but there are solutions for specific conditions.
> Since time immemorial, that turns out to be a very bad idea.
> It was with computing hardware. With OSs. With networks. With the web. With the cloud. And now with LLMs.
Nah. This way of thinking is the security people's variant of "only do things that scale", and it's what leads to hare-brained ideas like "let's replace laws and banking with smart contracts because you can't rely on trust at scale".
Not every system needs to be secure against everything. Systems that are fundamentally insecure in some scenarios are perfectly fine, as long as they're not exposed to those problem scenarios. That's how things work in the real world.
> If you have security-critical actions, then you must minimize the attack surface against them.
Now that's a better take. Minimize, not throw in the towel because the attack surface exists.
> Not every system needs to be secure against everything. Systems that are fundamentally insecure in some scenarios are perfectly fine, as long as they're not exposed to those problem scenarios.
That's a vanishingly rare situation, that I'm surprised to see you arguing for, given your other comments about the futility of enforcing invariants on reality. ;)
If something does meaningful and valuable work, that almost always means it's also valuable to exploit.
We can agree that if you're talking resource-commitment risk (i.e. must spend this much to exploit), there are insecure systems that are effective to implement, because the cost of exploitation exceeds the benefit. (Though warning: technological progress)
But fundamentally insecure systems are rare in practice for a reason.
And fundamentally insecure systems sooner or later get connected to things that should be secure and then become stepping stones in an exploit. These are lessons that should be learned by now.
Yes. It's a valid goal, and we'll keep pursuing it because it's a valid goal. There is no universal solution to this, but there are solutions for specific conditions.
> Since time immemorial, that turns out to be a very bad idea.
> It was with computing hardware. With OSs. With networks. With the web. With the cloud. And now with LLMs.
Nah. This way of thinking is the security people's variant of "only do things that scale", and it's what leads to hare-brained ideas like "let's replace laws and banking with smart contracts because you can't rely on trust at scale".
Not every system needs to be secure against everything. Systems that are fundamentally insecure in some scenarios are perfectly fine, as long as they're not exposed to those problem scenarios. That's how things work in the real world.
> If you have security-critical actions, then you must minimize the attack surface against them.
Now that's a better take. Minimize, not throw in the towel because the attack surface exists.