网络安全防御中存在两种截然不同的思维方式1。一种是黑客文化中的"安全即身份"观念，另一种是工程学的"安全即健壮性"理念1。有观点指出，过度依赖发现和修补漏洞的做法——即所谓的"打地鼠"策略——是一种失败的防御模式1。反复修补漏洞而不减少该类漏洞的复发本质上是无效的1。
真正的成功应该通过建立系统不变量和架构改进来预防漏洞的产生1。衡量防御效果的正确指标是使某个漏洞类别的发生率随时间下降并最终趋近于零1。漏洞赏金计划(VRP)的实际作用不在于完全列举所有漏洞，而是为安全团队的战略决策提供信息支撑1。防御者需要定义系统应该满足的不变量——违反这些不变量本身就是不良的，无论是否由攻击者引发1。
即使在AI时代，单纯依靠AI降低漏洞诊断成本也无法从根本上改变打地鼠策略的失败本质1。随着代码行数指数增长，仅用AI发现漏洞的成本也会呈指数上升，这体现了经济学中的杰文斯悖论1。若防御工作只停留在定义身份认同而不真正确立安全目标，其结果往往令人感到失败1。
A perspective shared on Hacker News argues that the cybersecurity industry's dominant approach to defense is fundamentally flawed 1. The article contends that endlessly discovering and patching individual vulnerabilities—described as "playing whack-a-mole"—represents a losing strategy because it fails to reduce the recurrence of vulnerability categories over time 1.
The author distinguishes between two competing philosophies: "security as identity," rooted in hacker culture, versus "security as robustness," grounded in engineering discipline 1. True progress, the argument suggests, should be measured not by the volume of vulnerabilities found, but by declining incident rates for specific vulnerability classes trending toward zero 1. Vulnerability reward programs, in this view, should serve to inform strategic decisions by security teams rather than attempt to enumerate every possible flaw 1.
The solution lies in establishing system invariants—properties that should always hold true—and addressing architectural deficiencies that permit violations of those invariants, regardless of whether attackers exploit them 1. Even as artificial intelligence becomes more prevalent in security work, cheaper vulnerability detection will not fundamentally change outcomes 1. The author invokes Jevons' paradox, noting that as codebases grow exponentially, the cost of AI-driven vulnerability discovery scales exponentially alongside them 1. Without shifting focus from identity-based thinking to defining explicit security goals, defensive efforts risk remaining perpetually reactive rather than achieving genuine resilience 1.
评论
还没有评论，欢迎留下第一条。