The following process seems to be a recurring one:

  1. Initial design. Commercial organisations invent and implement a design that seems at the time to work.

  2. Problem discovered, new design suggested. Due to new developments, or just because the designers missed something, a problem with the design is discovered. Academics find a solution to the problem, and a new design is proposed.

  3. Old, sub-optimal design persists due to existing production. However, the original sub-optimal design is maintained, because a large amount of devices with the old design are already deployed, and for various reasons (network effects, the need for compatibility between devices, etc), this means producers don't want to switch. Or alternatively, new production switches, but we still have to deal with the old design because of the large already produced devices.

I am looking for historical examples of such a process in the context of the IT security of CPU/instruction-set-architecture:

What designs of instruction sets/CPU's are we stuck with that are bad from a security perspective, but that are maintained because the cost of switching is high? (I can imagine that this is also intertwined with OS design and internet protocols).

  • 3
    $\begingroup$ I wonder if this might be a bit broad for our site format. Any votes from the community? $\endgroup$ – D.W. Jan 7 '20 at 18:14
  • $\begingroup$ @D.W. would it be ok if I restricted it to cpu design? $\endgroup$ – user56834 Jan 8 '20 at 5:30
  • $\begingroup$ For the original version of this question, I would have just said "Flash Player/NPAPI". (Still maintained until the end of this year!) $\endgroup$ – Aaron Rotenberg Feb 8 '20 at 7:45

There were some boo-boos with WiFi, thus the various generations of security protocols. Fortunately, most of the heavy lifting is done in firmware that is uploaded to the card/computer.

Initial (analog) cell phone technologies were trivial to intercept, newer (digital) ones much harder, but there were (are?) still gaps. Needless to say, switching required redoing much infrastructure and everybody getting new phones.

For some entertaining war stories, check out Ross Anderson's "Security engineering" (available as PDFs for each chapter on his homepage). Nicely written, a real classic.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.