Thread by @smdiehl

Let's talk about why the software industry is helpless to do anything about ransomware and why there's no technical solution anytime soon. (1/) 🧵

First let's discuss the scope of all software that exists, and it's nearly unfathomable. Your average Android phone runs on 15 million lines of code dating back to ancient 1970s era Unix toolchain code written by our grandparents generation. (2/)

Windows 10 contains over 50 million lines of code and no one person on Earth even fully understands in its entirety. It contains code from tens of thousands of global companies for running hundreds of thousands of devices all manufactured with different goals and standards. (3/)

Software is an inherently social process that in inexorably linked to the quirky microstructure of our markets, legal systems, and economic incentives that create it. Humans are messy and so is our code. (4/)

And the foundations of our code are creakingly old. Massive castles that are built on foundations of sand that kinda sorta work because of the tireless efforts of people maintaining critical sections that simply can never be allowed to fail. (5/)
xkcd.com/2347/

A good metaphor for software is that in Japan there's a Shinto shrine from 4 BCE that every 20 years gets rebuilt from scratch as a way of passing building techniques down from one generation to the next. Software craftsmanship is not that different. (6/)
en.wikipedia.org/wiki/Ise_Grand…

We're refreshing the foundations of software but incredibly slowly, because in our hyperfinancialized world having broken software that is backwards compatible and partially works is more Pareto optimal for a business than the risk of building anything from scratch. (7/)

When I used to do banking contracts we would regularly see large pieces of legacy COBOL software running on mainframes from 1970s for massive infrastructure for multibillion dollar markets. Everyone who wrote the software had died and no one understood how to rebuild it. (8/)

It's probably not incorrect to predict that in 150 years our children will still be running massive infrastructure written in Python 2.5 ( software from 2006 ) simply because nobody can incur the cost of rewriting it and it mostly still works. (9/)

Very few companies on Earth are capable of allocating resources and hiring enough people to make even a small dent in rewriting portions of our technology stack. We're talking tens of billions of dollars to replace even a small core library or a portion of an OS kernel. (10/)

And there's very little incentive to actually do that unless it impacts the corporate bottom line, so generally there's little reason to do it. Custom software at that level is insanely expensive to write. (11/)

And for most companies the IT department is a small massively underfunded cost centre of a business that have no say or control in their software, and beholden to a patchwork of greedy vendors whose interests are very misaligned. (12/)

A small community bank in Iowa or a fishing company in Nova Scotia just doesn't have budget, expertise, or resources to invest in cybersecurity because that's not how our market allocates resources. And probably never will. (13/)

The software development environment that gives rise to endless 0days and ransomware are a product of capitalism and the economic context that produces software, and there is no solution within that system. (14/)

Building correct or "high assurance software" is an open problem, and is extraordinary hard from a pure computer science perspective. Proving security properties about software is almost as hard as proving theorems in mathematics and is very slow and expensive at scale. (15/)

Now this isn't reason for complete despair. Software absolutely *does* get better on long glacially slow time scales. But it certainly isn't going improve quick enough to stave off the current ransomware crisis. (16/)

The only solution to ransomware is to stymie the darknet market that incentivize malicious actors to exploit new vulnerabilities through unregulated payment channel for extortion.

Fix the dark money payments and you make the crime unprofitable at scale. (17/)

Solving ransomware means cutting banks and payment networks off from crypto exchanges where all this dark money flows. Cryptocoins are nothing but gambling networks and shadow banking for trafficking in human suffering, a net negative for humanity.

They need to be banned.
/fin