Back in the last century, iirc, or the very early 2000’s, I logged-out of my desktop ( linux ) one time & discovered there was a new user on my machine…

the new username was “you are dead”.

1st time I knew I’d been cracked.

Not a nice feeling.

Educational, however, & motivating…

did me good.

I’m glad the person was more interested in communicating my trusting foolishness to me, than in doing real harm…

_ /\ _

From what I’ve read, thus-far, prohibiting autotools would be a good 1st-step.

Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.

I read an article, a couple years ago, about web-frameworks…

The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit…

Haskell’s got a kind of mantram: don’t bring in a whole framework, just compose what you need, yourself, together.

Its a granularity-difference.

Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn’t interested in Haskell ), is a liability nightmare.

But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world’s security in the ass.

It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.

To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.

That requires limiting what’s included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.

Consistently, at all levels, relentlessly.

It’s a chain: you cannot have a weak-link without compromising the whole chain.

You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.

There are 2 contradictory paradigms: the “magic bullet paradigm”, which doesn’t care how much rot, compromise, anything, so long as they include the “magic bullet” which takes-out the competitor…

… vs the “no weak-points, whatsoever, paradigm”, which doesn’t rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.

They are cultures, not just ideas.

Some people cannot tolerate a “no weak-points” culture, they “NEED” to compromise things ( I don’t care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.

It truly is a culture, or “religion”, and there’s no faking it.

Look to OpenBSD, & see what it takes to be like them…

Many years ago, it was discovered that Wine could run Windows viruses/worms/malware just fine, thank you very much…

“Sandboxing”, it isn’t.

It runs with all the privileges of the user running the app, iirc.

If you have the ability to take a look at either SANS website, and see their articles, or have your system show you all the automatic attacks hitting your machine, then maybe you will understand…

Botnets are coded to hammer-away at all possible internet-addresses, trying to break-in & highjack more machines, to include in the established criminal-machine that the botnet is…

SANS said, a decade or 2 ago, that it took, on average, something like 6 or 4 minutes for a new MS-Windows machine to be owned by some attack from the internet.

I’ve had linux machines cracked/owned, and wiped 'em to get 'em clean.

Having no immune-system is BAD.

Linux botnets, apple operating-system botnets, they exist.

I don’t think there is any operating-system that is connected to the internet that doesn’t have attacks coded to crack it.

I just looked at SANS.org, and they have totally changed, so they are now … more a moneymaking-machine wanting B2B biz?

Here, though, are some cheat-sheets they made:

https://www.sans.org/posters/?msc=main-nav

They used to tell us the top-20 most effective protections for particular threats, identifying how prevalent the threats were, etc…

No idea who does that nowadays…

Please consider using John Truby’s book ( or even the cover of it ) “The Anatomy of Genres” for identifying the 14 Genres of story.

Myth, Epic, Western, etc…

“adventure” isn’t a genre: it occurs in multiple genres, serving as the canvas on-which the genre’s points are written…

That book, btw, is an awesome bunch of psychology.

Some minor errors, like mis-defining comedy…

( proper definition of humour: “improbable violation of expectation”, or a strange-loop form )

…to be made of a “drop”, a debasing, or put-down, or reduction of somebody…? Maybe in the US, but it isn’t the true fundamental root of humour.

sooo much gold in that book, though: definitely worth investing in.

( for anybody wanting the core competencies in writing, I’d say that both John Truby’s books, and Shaun Coyne’s “The Story Grid” are books that are required, and they are the top/core competencies. Coyne recommends McKee, as well. )